Sm3 hash algorithm acceleration processors, methods, systems, and instructions

ABSTRACT

A processor includes a decode unit to decode an SM3 two round state word update instruction. The instruction is to indicate one or more source packed data operands. The source packed data operand(s) are to have eight 32-bit state words A j , B j , C j , D j , E j , F j , G j , and H j  that are to correspond to a round (j) of an SM3 hash algorithm. The source packed data operand(s) are also to have a set of messages sufficient to evaluate two rounds of the SM3 hash algorithm. An execution unit coupled with the decode unit is operable, in response to the instruction, to store one or more result packed data operands, in one or more destination storage locations. The result packed data operand(s) are to have at least four two-round updated 32-bit state words A j+2 , B j+2 , E j+2 , and F j+2 , which are to correspond to a round (j+2) of the SM3 hash algorithm.

RELATED APPLICATIONS

The present application is a continuation of U.S. patent applicationSer. No. 14/477,552, filed on Sep. 4, 2014, entitled “SM3 HASH ALGORITHMACCELERATION PROCESSORS, METHODS, SYSTEMS, AND INSTRUCTIONS”, nowpatented as U.S. Pat. No. 9,317,719, issued on Apr. 19, 2016, which ishereby incorporated herein by reference in its entirety and for allpurposes

BACKGROUND

1. Technical Field

Embodiments described herein relate to processors. In particular,embodiments described herein relate to the evaluation of hash algorithmswith processors.

2. Background Information

Hash functions or algorithms are a type of cryptographic algorithm thatare widely used in computer systems and other electronic devices. Thehash algorithms generally take a message as an input, generate acorresponding hash value or digest by applying the hash function to themessage, and output the hash value or digest. Typically, the same hashvalue should be generated if the same hash function is evaluated withthe same message. Such hash algorithms are used for various purposes,such as for verification (e.g., verifying the integrity of files, data,or messages), identification (e.g., identifying files, data, ormessages), authentication (e.g., generating message authenticationcodes), generating digital signatures, generating pseudorandom numbers,and the like. As one illustrative example, a hash function may be usedto generate a hash value for a given message. At a later time, a hashvalue may be recomputed for the given message using the same hashfunction. If the hash values are identical, then it can be assumed thatthe message hasn't been changed. In contrast, if the hash values aredifferent, then it can be assumed that the message has been changed.

One known type of hashing algorithm is the SM3 hash function. The SM3hash algorithm has been published by the Chinese Commercial CryptographyAssociation Office and approved by the Chinese government. The SM3 hashalgorithm has been specified as the hashing algorithm for the TCM(Trusted Computing Module) by the China Information SecurityStandardization Technical Committee (TC260) initiative. An Englishlanguage description of the SM3 hash function has been published as theInternet Engineering Task Force (IETF) Internet-Draft entitled “SM3 HashFunction,” by S. Shen and X. Lee, on Oct. 24, 2011.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention may best be understood by referring to the followingdescription and accompanying drawings that are used to illustrateembodiments. In the drawings:

FIG. 1 is a block diagram of an instruction set of a processor thatincludes one or more SM3 hash algorithm acceleration instructions.

FIG. 2 illustrates the compression function of the SM3 hash algorithm.

FIG. 3 is a block diagram of an embodiment of a processor that isoperable to perform an embodiment of an SM3 two round at least four (orin some embodiments eight) state word update instruction.

FIG. 4 is a block flow diagram of an embodiment of a method ofperforming an embodiment of an SM3 two round at least four (or in someembodiments eight) state word update instruction.

FIG. 5 is a block diagram illustrating an embodiment of an SM3 two roundeight state word update operation.

FIG. 6 is a block diagram illustrating an embodiment of an SM3 two roundfour remaining state word update operation.

FIG. 7 is a block diagram illustrating an embodiment of an SM3 fourmessage expansion initiation operation.

FIG. 8 is a block diagram illustrating an embodiment of an SM3 fourmessage expansion completion operation.

FIG. 9A is a block diagram illustrating an embodiment of an in-orderpipeline and an embodiment of a register renaming out-of-orderissue/execution pipeline.

FIG. 9B is a block diagram of an embodiment of processor core includinga front end unit coupled to an execution engine unit and both coupled toa memory unit.

FIG. 10A is a block diagram of an embodiment of a single processor core,along with its connection to the on-die interconnect network, and withits local subset of the Level 2 (L2) cache.

FIG. 10B is a block diagram of an embodiment of an expanded view of partof the processor core of FIG. 10A.

FIG. 11 is a block diagram of an embodiment of a processor that may havemore than one core, may have an integrated memory controller, and mayhave integrated graphics.

FIG. 12 is a block diagram of a first embodiment of a computerarchitecture.

FIG. 13 is a block diagram of a second embodiment of a computerarchitecture.

FIG. 14 is a block diagram of a third embodiment of a computerarchitecture.

FIG. 15 is a block diagram of an embodiment of a system-on-a-chiparchitecture.

FIG. 16 is a block diagram of use of a software instruction converter toconvert binary instructions in a source instruction set to binaryinstructions in a target instruction set, according to embodiments ofthe invention.

DETAILED DESCRIPTION OF EMBODIMENTS

Disclosed herein are SM3 hash algorithm acceleration instructions,processors to execute the instructions, methods performed by theprocessors when processing or executing the instructions, and systemsincorporating one or more processors to process or execute theinstructions. In the following description, numerous specific detailsare set forth (e.g., specific instruction operations, data formats,arrangement of data elements within operands, processor configurations,microarchitectural details, sequences of operations, etc.). However,embodiments may be practiced without these specific details. In otherinstances, well-known circuits, structures and techniques have not beenshown in detail to avoid obscuring the understanding of the description.

FIG. 1 is a block diagram of an instruction set 100 of a processor thatincludes one or more SM3 hash algorithm acceleration instructions 102.The SM3 acceleration instruction(s) may help to accelerateimplementations of the SM3 hash algorithm. The instruction set is partof the instruction set architecture (ISA) of the processor and includesthe native instructions that the processor is operative to perform. Theinstructions of the instruction set (e.g., including the SM3acceleration instructions) represent macroinstructions, assemblylanguage instructions, or machine-level instructions that are providedto the processor for execution. These instructions are contrasted tomicroinstructions, micro-ops, or other instructions that result fromdecoding the instructions of the instruction set.

In some embodiments, the SM3 acceleration instruction(s) 102 may includean SM3 two round at least four (or in some embodiments eight) state wordupdate instruction 104. When performed, the SM3 two round state wordupdate instruction 103 may be operable to cause the processor to updateat least four (or in some embodiments eight) of the state words of theSM3 hash algorithm by two rounds.

In embodiments where the instruction 104 is optionally an SM3 two roundfour state word update instruction 104, the instructions 102 mayoptionally include an SM3 two round four remaining state word updateinstruction 106. When performed, the instruction 106 may be operable tocause the processor to update a remaining four of the eight state words(e.g., the four not updated by the instruction 104). Alternatively,these remaining four state words may optionally instead be updated bysoftware (e.g., through a sequence of conventional instructions).

In some embodiments, the instruction(s) 102 may optionally include oneor more instructions to assist with message scheduling, although this isnot required. For example, in some embodiments, the instruction(s) 102may optionally include an SM3 four message expansion initiationinstruction 108. When performed, the instruction 108 may be operable tocause the processor to initiate and/or partially perform the expansionof four messages. In some embodiments, the instruction(s) 102 mayoptionally include an SM3 four message expansion completion instruction110 designed to work with the initiation instruction 108. Whenperformed, the instruction 110 may be operable to cause the processor tofinish or complete the expansion of the four messages.

As shown, in some embodiments, the instruction set 100 may include fourdifferent SM3 hash function acceleration instructions 102. However, inother embodiments, only any single one, or a subset of any one or moreof these instructions 102, may optionally be included in the instructionset 100. Although including all of the four instructions may tend toprovide the greatest amount of acceleration, some acceleration may beachieved by including any one or more of these instructions.

FIG. 2 illustrates the compression function 212 of the SM3 hashalgorithm suitable for embodiments. The SM3 hash algorithm accepts amessage as input. The message may represent a bit string of arbitrarylength. The SM3 hash algorithm performs a number of operations using theinput message and generates a hash value or digest having a length of256-bits after padding and iterative compression.

Initially, the 256-bit state value V(i) is partitioned into eight 32-bitstate words A, B, C, D, E, F, G, and H. The initial state value V(0) forthe first iteration is a constant defined by the SM3 hash algorithm. Thestate words A through H are specified in “Big Endian” format accordingto the algorithm but their format in an implementation may vary ifdesired.

An iterative procedure is then performed on the sequence of blocks. TheSM3 hash algorithm includes sixty-four iterations or “rounds” (i.e.,from j ranging from 0 to 63). As shown, a single round 213 includes anumber of different operations. The leftward pointing arrow symbol (←)represents storing, assigning, or equating the value or parameter on theright to the value or parameter on the left. The symbol “<<<” representsa rotate operation. The symbol of the encircled plus sign (⊕) representsa logical exclusive OR (XOR) operation. T_(j) is a constant having avalue as specified in the SM3 hash function that depends on theiteration (i.e., the value of j). For example, T_(j) may have value. Thevariables SS1, SS2, TT1, and TT2 are internal 79cc4519 for 0≦j≦15 andthe value 7a879d8a for 16≦j≦63 intermediate values used in theiterations.

FF_(j) is a Boolean function which varies with round number (j)according to Equation 1:

FF _(j)(X,Y,Z)=X XOR Y XOR Z (0≦j≦15); or =(X AND Y) OR (X AND Z) OR (YAND Z) (16≦j≦63)  Equation 1

GG_(j) is a Boolean function which varies with round number (j)according to Equation 2:

GG _(j)(X,Y,Z)=X XOR Y XOR Z (0≦j≦15); or =(X AND Y) OR (NOT X AND Z)(16≦j≦63)  Equation 2

P₀ is a permutation function in compression function according toEquation 3:

P ₀(X)=X XOR (X<<<9) XOR (X<<<17)  Equation 3

Notice that the term W_(j) is added to the evaluation of the Booleanfunction GG_(j). Also, the term W′_(j) is added to the evaluation of theBoolean function FF_(j). The terms W_(j) and W′_(j) represent messageterms, message inputs, or simply messages. For iterations 0 to 15, theterms W₀ to W₁₅ are obtained from the 512-bit block being compressed. Inparticular, the 512-bit message block being compressed is divided orpartitioned into sixteen 32-bit words referenced in big-endian format asW₀ to W₁₅. The remaining messages W_(j) and W′_(j) are calculated duringa message extension or message expansion portion of the SM3 hashalgorithm.

The W_(j) messages for iterations 16 to 67 may be calculated accordingto the following Equation 4:

W _(j) =P ₁(W _(j−16) XOR W _(j−9) XOR (W _(j−3)<<<15)) XOR (W_(j−13)<<<7) XOR W _(j−6)  Equation 4

In Equation 4, Pi(X) is a permutation function for message expansionthat is defined by the following Equation 5:

P ₁(X)=X XOR (X<<<15) XOR (X<<<23)  Equation 5

The W_(j) messages for iterations 16 to 67 may be calculated accordingto Equation 4 with the permutation function P₁ according to Equation 5.Notice that the calculation of a W_(j) message for a given round (e.g.,round j) depend on messages from earlier rounds.

In particular, as can be readily seen in Equation 4, the W_(j) messagefor a given round (e.g., round j) depends on the prior round messagesW_(j−16), W_(j−13), W_(j−9), W_(j−6), and W_(j−3). W_(j−3) is themessage from three rounds back relative to round j, W_(j−16) is themessage from sixteen rounds back relative to round j, and so on.

The W′_(j) messages may be calculated or derived from the W_(j) messagesaccording to the following Equation 6:

W′ _(j)=W_(j) XOR W _(j+4)  Equation 6

Notice that the W′_(j) message depends on the W_(j) message from thesame round as well as on the W_(j+4) message from four rounds ahead.Since W₀ to W₁₅ are divided or obtained from the 512-bit message blockbeing compressed, messages W′₀ to W′₁₁ may be determined using Equation6 based on the initially known messages W₀ to W₁₅. The remainingmessages W′₁₂ to W′₆₃ may be determined from messages W₁₆ to W₆₇, whichmay be calculated using Equations 4-5. Notice that W₆₄ to W₆₇ may becalculated, even though they are not input directly into the compressionfunction, but are needed to calculate W′₆₀ to W′₆₃.

One challenge is that implementing the SM3 hash algorithm in processorsgenerally tends to be computationally intensive. For example, as can bereadily seen from FIG. 2 and Equations 1-3, updating the state words foreach round involves a large number of different operations.Specifically, during each round a large number of XOR operation, rotateoperations, and other operations typically need to be performed.

In addition, there are a large number of rounds (e.g., 64-rounds).Conventionally, without the SM3 hash algorithm two round state wordupdate instructions disclosed herein, updating the state words by tworounds of the algorithm generally tends to involve executing a largenumber of separate instructions. For example, conventionally it ispossible that a separate instruction may be used for each XOR operation,for each rotate operation, etc. Additional instructions may alsopotentially be needed to move or rearrange data to prepare it for thenext round. As a result, the performance of the rounds in software byseparate more general-purpose instructions tends to be poor. This fact,compounded with the large number of rounds to be performed, generallytends to make the implementation of the SM3 hash algorithm verycomputationally intensive and/or take a significant amount of time.

FIG. 3 is a block diagram of an embodiment of a processor 320 that isoperable to perform an embodiment of an SM3 two round at least four (orin some embodiments eight) state word update instruction 304. In someembodiments, the processor may be a general-purpose processor (e.g., ageneral-purpose microprocessor of the type used in desktop, laptop, orother computers). Alternatively, the processor may be a special-purposeprocessor. Examples of suitable special-purpose processors include, butare not limited to, network processors, communications processors,cryptographic processors, graphics processors, co-processors, embeddedprocessors, digital signal processors (DSPs), and controllers (e.g.,microcontrollers). The processor may be any of various complexinstruction set computing (CISC) processors, reduced instruction setcomputing (RISC) processors, very long instruction word (VLIW)processors, hybrids thereof, other types of processors, or have acombination of such different processors (e.g., in different cores).

During operation, the processor 320 may receive the embodiment of theSM3 two round state word update instruction 304. For example, theinstruction 304 may be received from an instruction fetch unit, aninstruction queue, or the like. The instruction 304 may represent amacroinstruction, assembly language instruction, machine codeinstruction, or other instruction or control signal of an instructionset of the processor.

In some embodiments, the instruction 304 may explicitly specify (e.g.,through one or more fields or a set of bits), or otherwise indicate(e.g., implicitly indicate, etc.), one or more source packed dataoperands 330. In some embodiments, the one or more source packed dataoperands 330 may have eight 32-bit state words to be input to a currentSM3 round (j) 331 (e.g., A_(j), B_(j), C_(j), D_(j), E_(j), F_(j),G_(j), H_(j)). In some embodiments, the one or more source packed dataoperands 330 may also have message information 335 (e.g., a set ofmessages) sufficient to evaluate the next two subsequent and sequentialSM3 rounds apportioned among any desired number of source operands andin any desired order. As one example, this message information mayinclude the four messages W_(j), W_(j+1), W′_(j), W′_(j+1). As anotherexample, this message information may include the four messages W_(j),W_(j+1), W_(j+4), W_(j+5). Still other message information is possible,as will be apparent to those skilled in the arts and having the benefitof the present disclosure. These state words and messages may beapportioned among any desired number and size of one or more sourceoperands and may be in any desired order. The scope of the invention isnot particularly limited to the number of source packed data operandsused to provide the input data, the sizes thereof, or to thearrangements of the data within the operands, although certainefficiencies and/or advantages may be achieved through certainarrangements of the data within the operands from an overall algorithmicperspective (e.g., by reducing operations to rearrange data elements fordifferent iterations), as will be appreciated by those skilled in thearts and having the benefit of the present disclosure. The specificexamples disclosed elsewhere herein are believed to be beneficial butare certainly not required.

In some embodiments, the instruction may also specify or otherwiseindicate a round number (e.g., the current round j ranging from 0 to63), such as, for example, by a data element in the one or more sourcepacked data operands, a field of the instruction 304 (e.g., animmediate), a value in a general-purpose register (e.g., specified by orimplicit to the instruction), or otherwise. In some embodiments, theinstruction 304 may also explicitly specify (e.g., through one or morefields or a set of bits), or otherwise indicate (e.g., implicitlyindicate, etc.), one or more destination storage locations where one ormore result packed data operands 336 are to be stored in response to theinstruction.

The processor 320 includes a set of packed data registers 328. Each ofthe packed data registers may represent an on-die storage location thatis operable to store packed data, vector data, or SIMD data. The packeddata registers may be implemented in different ways in differentmicroarchitectures using well-known techniques and are not limited toany particular type of circuit. Examples of suitable types of registersinclude, but are not limited to, dedicated physical registers,dynamically allocated physical registers using register renaming, andcombinations thereof.

As shown, in some embodiments, the one or more source packed dataoperands 330 may optionally be stored in one or more packed dataregisters 328. Similarly, in some embodiments, the one or more resultpacked data operands 336 may optionally be stored in one or more packeddata registers 328. Alternatively, memory locations, or other storagelocations, may be used for one or more of these operands. Moreover,although the source operand(s) 330 and result operand(s) 336 are shownas being separate in the illustration, in some embodiments, a packeddata register or other storage location used for a source operand may bereused for a result operand (e.g., an instruction may implicitlyindicate that a result packed data operand is to be written over aspecified source packed data operand).

When one or more packed data registers are used to store the one or moresource packed data operands, they generally need to be of sufficientsize and/or number to store the associated operands. Generally, either arelatively greater number of smaller packed data registers may be used,or a relatively lesser number of larger packed data registers may beused, or a combination of both larger and smaller registers may be used.As previously mentioned, in some embodiments, the one or more sourcepacked data operands 330 may have eight 32-bit state words of a currentSM3 round 331 (e.g., A_(j), B_(j), C_(j), D_(j), E_(j), F_(j), G_(j),H_(j)). In embodiments, the one or more source packed data operands 330may also have message information 335, such as four 32-bit messages(e.g., either W_(j), W_(j+1), W′_(j), W′_(j+1); or W_(j), W_(j+1),W_(j+4), W_(j+5)). Collectively, this includes a total of twelve 32-bitdata elements and/or 384-bits of input data.

In some embodiments, three 128-bit packed data registers may be used tostore this input data. In some embodiments, 128-bit packed dataregisters may be used even if a processor has wider packed dataregisters (e.g., 256-bit registers), such as, for example, to allow theinstructions to be used on other processors without such widerregisters. In other embodiments, one 256-bit register and one 128-bitregister may be used to store this input data. In other embodiments, two128-bit packed data registers and two 64-bit packed data registers maybe used to store this input data. In still other embodiments, six 64-bitpacked data registers may be used to store this input data. In stillother embodiments, other combinations of 256-bit, 128-bit, 64-bit, orother sized registers (e.g., 32-bit, 512-bit, etc.) may optionally beused to store the one or more source packed data operands. In caseswhere relatively large numbers of registers are used (e.g., four to sixor more), rather than having the instruction specify all registers(e.g., thereby increasing the instruction length), one or more registersmay be specified and one or more sequential/next registers may beimplicit to the instruction (e.g., to an opcode).

Referring again to FIG. 3, the processor includes a decode unit ordecoder 322. The decode unit may receive and decode the instruction 304and output one or more microinstructions, micro-operations, micro-codeentry points, decoded instructions or control signals, or otherrelatively lower-level instructions or control signals that reflect,represent, and/or are derived from the instruction 304. The one or morelower-level instructions or control signals may implement thehigher-level instruction 304 through one or more lower-level (e.g.,circuit-level or hardware-level) operations. In some embodiments, thedecode unit may include one or more input structures (e.g., port(s),interconnect(s), an interface) to receive the instruction, aninstruction recognition and decode logic coupled with the inputstructure to recognize and decode the instruction, and one or moreoutput structures (e.g., port(s), interconnect(s), an interface) coupledwith the instruction recognition and decode logic to output the one ormore corresponding lower level instructions or control signals. Thedecode unit may be implemented using various different mechanismsincluding, but not limited to, microcode read only memories (ROMs),look-up tables, hardware implementations, programmable logic arrays(PLAs), and other mechanisms used to implement decode units known in theart. In some embodiments, instead of the instruction 304 being provideddirectly to the decode unit, it may be provided to an instructionemulator, translator, morpher, interpreter, or other instructionconversion module that may convert it into one or more otherinstructions to be decoded.

Referring again to FIG. 3, an SM3 hash function two round at least fourstate word update execution unit 324 is coupled with the decode unit 322and the packed data registers 328. For simplicity, the unit 324 may alsobe referred to herein as an SM3 execution unit, or simply as anexecution unit. The execution unit may receive the one or more decodedor otherwise converted instructions or control signals that representand/or are derived from the instruction 304. The execution unit may alsoreceive the one or more source packed data operand(s) 330 indicated bythe instruction 304. The execution unit is operable in response toand/or as a result of the instruction 304 (e.g., in response to one ormore instructions or control signals decoded from the instruction) tostore the one or more result packed data operand(s) 336 in one or morecorresponding destination storage location(s) indicated by theinstruction 304.

In some embodiments, the one or more result packed data operand(s) 336may have at least four two-round updated 32-bit state words updated bytwo SM3 rounds relative to a given round corresponding to the one ormore source packed data operands 330. For example, in one embodiment,the result operand(s) 336 may include A_(j+2), B_(j+2), E_(j+2), andF_(j+2) apportioned among any desired number of operands and in anydesired order. A_(j+2), B_(j+2), E_(j+2), and F_(j+2), respectively, areupdated by two SM3 rounds relative to A_(j), B_(j), E_(j), and F_(j). Insome embodiments, the result operand(s) 336 may optionally have at leasteight 32-bit state words updated by the two SM3 rounds (e.g., A_(j+2),B_(j+2), C_(j+2), D_(j+2), E_(j+2), F_(j+2), G_(j+2), and H_(j+2))apportioned among any desired number of operands and in any desiredorder, although this is not required. In some embodiments, the executionunit 324 in response to the instruction 304 may store any of the resultsshown and described for FIG. 5, including the described variations andalternatives thereof, although the scope of the invention is not solimited. Advantageously, the SM3 two round state word update instructionmay significantly help to increase the speed, efficiency, and/orperformance of implementing the SM3 message generation (e.g., byavoiding an otherwise high instruction count and complexity throughconventional software approaches).

In some embodiments, the execution unit may perform all operations of around for each of the two rounds (e.g., the operations shown for singleround 213). Alternatively, certain of these operations may optionally beomitted. For example, in the case of a four state word updateinstruction, certain operations that would be needed to generate theremaining four state words may optionally be omitted (e.g., operationsto generate C_(j+2), D_(j+2), G_(j+2), H_(j+2) in the second round mayoptionally be omitted). As another example, certain operations mayoptionally be performed outside of the confines of the execution of theinstruction/operation. For example, A_(j)<<<12 may optionally beperformed by a separate instruction, T_(j)<<<j may optionally beperformed by a separate instruction, etc. Moreover, it is to beappreciated that the particular illustrated operations shown for theround 213 need not necessarily be performed for the rounds. For example,certain optionally may optionally be implemented by one or morecomputationally equivalent substitute operations. For example, XORscould be implemented by a combination of other Boolean operations,rotates could be implemented by bit extraction operations, etc. It is tobe appreciated that use of the terms “two rounds,” “two round state wordupdate instructions,” and like terms herein, encompass and allow forsuch possibilities.

Collectively, the one or more result packed data operands may include atotal of either four 32-bit data elements or 128-bits (e.g., in the caseof four state elements updated) or eight 32-bit data elements or256-bits (e.g., in the case of eight state elements updated). In someembodiments, one 128-bit packed data register may be used to store four32-bit state words updated by two rounds, or two 128-bit packed dataregisters may be used to store eight 32-bit state words updated by tworounds. In other embodiments, two 64-bit packed data registers may beused to store four 32-bit state words updated by two rounds, or four64-bit packed data registers may be used to store eight 32-bit statewords updated by two rounds. In still other embodiments, a 256-bitpacked data register may be used to store either four or eight 32-bitstate words updated by two rounds. In still other embodiments, othercombinations of 256-bit, 128-bit, 64-bit, or other sized registers(e.g., 32-bit, 512-bit, etc.) may optionally be used to store the one ormore source packed data operands. Alternatively, memory locations orother storage locations may optionally be used, if desired. The scope ofthe invention is not particularly limited to the number of resultoperands, the sizes thereof, or to the arrangement of the data in theresult operands, although certain efficiencies and/or advantages may beachieved through certain arrangements of the data within the resultoperands from an overall algorithmic perspective (e.g., by reducingoperations to rearrange data elements for different iterations), as willbe appreciated by those skilled in the arts and having the benefit ofthe present disclosure. The specific examples disclosed elsewhere hereinare believed to be beneficial but are certainly not required.

Referring again to FIG. 3, the execution unit 324 and/or the processor320 may include specific or particular logic (e.g., transistors,integrated circuitry, or other hardware potentially combined withfirmware (e.g., instructions stored in non-volatile memory) and/orsoftware) that is operable to perform the instruction 304 and/or storethe result in response to and/or as a result of the instruction 304(e.g., in response to one or more instructions or control signalsdecoded or otherwise derived from the instruction 304). In someembodiments, the circuitry or logic may include SM3 two round evaluationlogic 326, such as, for example, XOR logic, rotate logic, AND logic, ORlogic, NOT logic, etc.

In some embodiments, to help avoid unduly increasing die area and/orpower consumption, some of the hardware or other logic used to implementthe SM3 two round state word update instruction, or other instructionsdisclosed herein, may optionally be reused to implement one or moreother encryption instructions, such as, for example, those used toimplement a Secure Hash Algorithm (e.g., SHA-2). For example, in someembodiments, hardware or logic used to implement the Boolean functionsFF_(j) (e.g., for when j>15) and GG_(j) (e.g., for when j>15) mayoptionally be reused to implement the counterpart Maj (majority) and Ch(choose) functions of SHA-2. As another example, in some embodiments,hardware or logic used to perform additions in SM3 (e.g., one or moreadders) may optionally be reused to implement additions in SHA-2. SomeXOR and rotate logic may also optionally be reused.

To avoid obscuring the description, a relatively simple processor 320has been shown and described. In other embodiments, the processor mayoptionally include other well-known processor components. Possibleexamples of such components include, but are not limited to, aninstruction fetch unit, instruction and/or data L1 caches, second orhigher level caches (e.g., an L2 cache), an instruction scheduling unit,a register renaming unit, a reorder buffer, a retirement unit, a businterface unit, instruction and data translation lookaside buffers(TLBs), other components included in processors, and variouscombinations thereof.

FIG. 4 is a block flow diagram of an embodiment of a method 490 ofperforming an SM3 two round at least four (or in some embodiments eight)state word update instruction. In some embodiments, the operationsand/or method of FIG. 4 may be performed by and/or within the processorof FIG. 3. The components, features, and specific optional detailsdescribed herein for the processor of FIG. 3, also optionally apply tothe operations and/or method of FIG. 4. Alternatively, the operationsand/or method of FIG. 4 may be performed by and/or within a similar ordifferent apparatus. Moreover, the processor of FIG. 3 may performoperations and/or methods the same as, similar to, or different thanthose of FIG. 4.

The method includes receiving the SM3 two round state word updateinstruction, at block 491. In various aspects, the instruction may bereceived at a processor, an instruction processing apparatus, or aportion thereof (e.g., an instruction fetch unit, a decode unit, a businterface unit, etc.). In various aspects, the instruction may bereceived from an off-die source (e.g., from memory, interconnect, etc.),or from an on-die source (e.g., from an instruction cache, instructionqueue, etc.). The SM3 two round state word update instruction mayspecify or otherwise indicate one or more source packed data operands.The one or more source packed data operands may have eight 32-bit statewords A_(j), B_(j), C_(j), D_(j), E_(j), F_(j), G_(j), and H_(j) for around (j) of an SM3 hash algorithm. The one or more source packed dataoperands may also have four messages that are sufficient to evaluate tworounds of the SM3 hash algorithm.

One or more result packed data operands may be stored, in one or moredestination storage locations indicated by the instruction, in responseto and/or as a result of the instruction, at block 492.Representatively, an execution unit, instruction processing apparatus,or processor may perform the instruction and store the result. In someembodiments, the one or more result packed data operands having at leastfour two-round updated 32-bit state words A_(j+2), B_(j+2), E_(j+2), andF_(j+2), which have been updated by the two rounds of the SM3 hashalgorithm relative to A_(j), B_(j), E_(j), and F_(j). In someembodiments, the method may optionally include receiving any of thesource operands and storing any of the results shown in FIG. 5,including the variations and alternatives mentioned therefor, althoughthe scope of the invention is not so limited.

The illustrated method involves architectural operations (e.g., thosevisible from a software perspective). In other embodiments, the methodmay optionally include one or more microarchitectural operations. By wayof example, the instruction may be fetched, decoded, scheduledout-of-order, source operands may be accessed, an execution unit mayperform microarchitectural operations to implement the instruction, etc.The microarchitectural operations to implement the instruction mayoptionally include any of the operations of an SM3 round (e.g., round213).

FIG. 5 is a block diagram illustrating an embodiment of an SM3 two roundstate word update operation 540 that may be performed in response to anembodiment of an SM3 two round state word update instruction. In theillustrated embodiment, the instruction specifies or otherwise indicatesa first 128-bit source packed data operand 530, a second 128-bit sourcepacked data operand 532, and a third 128-bit source packed data operand534. The use of 128-bit operands may offer certain advantages, forexample allowing use of the instructions in processors that have 128-bitpacked data registers but not 256-bit packed data registers, but is notrequired. In other embodiments, different numbers and sizes of operandsmay optionally be used (e.g., 64-bit operands, 256-bit operands, acombination of different sizes, etc.).

In the illustrated embodiment, the first 128-bit source packed dataoperand 530 has a first four 32-bit state words for input to the currentround (j), and the second 128-bit source packed data operand 532 has asecond four 32-bit state words for input to the current round (j).Specifically, in the illustrated embodiment, the first source operand530 has, from a least significant bit position on the right to a mostsignificant bit position on the left, the 32-bit state element A_(j) inbits [31:0], B_(j) in bits [63:32], E_(j) in bits [95:64], and F_(j) inbits [127:96]. In other embodiments, a reverse order may also optionallybe used. The second source operand 532 has, also from a leastsignificant bit position on the right to a most significant bit positionon the left, the 32-bit state elements C_(j) in bits [31:0], D_(j) inbits [63:32], G_(j) in bits [95:64], and H_(j) in bits [127:96]. Inother embodiments, a reverse order may also optionally be used. Theillustrated arrangement may offer certain advantages, but is notrequired. In other embodiments, the eight 32-bit state words may berearranged variously among the available source operands.

The illustrated third source packed data operand 534 has messageinformation (e.g., a set of four messages) sufficient to evaluate twoSM3 rounds. Specifically, the illustrated third source packed dataoperand 534 has the four messages W_(j), W_(j+1), W_(j+4), and W_(j+5).The messages W_(j+4) and W_(j) are sufficient to calculate the messageW′_(j) according to Equation 6. Similarly, the messages W_(j+5) andW_(j+1) are sufficient to calculate the message W′_(j+1) according toEquation 6. In another embodiment, the instruction may indicate one ormore source operands providing the four messages W_(j), W_(j+1), W′_(j),and W′_(j+1). In still other embodiments, other combinations of messagesmay be used as long as the needed messages for two rounds are eitherprovided or can be calculated or derived from the information provided(e.g., W_(j), W_(j+1), W′_(j), W_(j+5)).

Referring again to FIG. 5, a first result packed data operand 536 may begenerated (e.g., by an execution unit 524) and stored in a destinationstorage location in response to the SM3 two round state word updateinstruction. The destination storage location may be specified orotherwise indicated by the instruction. In various embodiments, thedestination storage location may be a packed data register, a memorylocation, or other storage location. In some embodiments, the firstresult packed data operand 536 may include four 32-bit state wordsupdated by two SM3 rounds. For example, in the illustrated embodiment,the first result packed data operand 536 has, the 32-bit state elementsA_(j+2) in bits [31:0], B_(j+2) in bits [63:32], E_(j+2) in bits[95:64], and F_(j+2) in bits [127:96]. In other embodiments, a reverseorder may also optionally be used. Moreover, although the illustratedarrangement may offer certain advantages, in other embodiments, thestate words may optionally be rearranged variously within the operand.

In some embodiments, in the optional case of an SM3 two round eightstate word update instruction, a second result packed data operand 538may be generated and stored in a second destination storage location inresponse to the instruction. The second destination storage location maybe specified or otherwise indicated by the instruction. In variousembodiments, the second destination storage location may be a packeddata register, a memory location, or other storage location. In someembodiments, the second result packed data operand 538 may include theremaining four 32-bit state words, which were not included in the firstresult packed data operand 536, which have been updated by two SM3rounds. Specifically, in the illustrated embodiment, the second resultpacked data operand 538 has, the 32-bit state elements C_(j+2) in bits[31:0], D_(j+2) in bits [63:32], G_(j+2) in bits [95:64], and H_(j+2) inbits [127:96]. In other embodiments, a reverse order may also optionallybe used. Moreover, although the illustrated arrangement may offercertain advantages, various inter-operand and intra-operandrearrangements are contemplated.

Notice that, in some embodiments, the first result packed data operand536 may optionally include the same corresponding type of state words(e.g., A, B, E, F) as the first source packed data operand 530, and inthe same order. Also, in some embodiments, the second result packed dataoperand 538 may optionally include the same corresponding type of statewords (e.g., C, D, G, H) as the second source packed data operand 532,and in the same order. This is not required, but may tend to providecertain efficiencies and/or advantages from an overall algorithmicperspective (e.g., by making management of the state words betweenrounds more efficient).

The second result packed data operand 538 of FIG. 5 is optional notrequired. In other embodiments, in the optional case of an SM3 two roundfour state word update instruction/operation, the first result packeddata operand 536 (e.g., A_(j+2), B_(j+2), E_(j+2), F_(j+2) in anydesired order) may be stored, but not second result packed data operand538 (e.g., not C_(j+2), D_(j+2), G_(j+2), H_(j+2)). Notice that one ofthe source operands includes A_(j), B_(j), E_(j), and F_(j), and theother source operand includes C_(j), D_(j), G_(j), and H_(j). Thisparticular grouping of these types of state words within the sameoperands offers an advantage when only four state words are updated bytwo rounds (e.g., A_(j+2), B_(j+2), E_(j+2), F_(j+2) generated). As willbe explained further below (e.g., in conjunction with FIG. 6), the otherfour state words updated by two rounds (e.g., C_(j+2), D_(j+2), G_(j+2),H_(j+2)) may be readily generated from A_(j), B_(j), E_(j), and F_(j),such as, for example, by software or by an additional SM3 accelerationinstruction (e.g., instruction 106 and/or instruction described for FIG.6). The particular illustrated grouping of the different-typed statewords among the operands offers less advantage when all eight statewords are updated by two rounds by performing a single instruction. Insuch cases, although some arrangements may tend to offer more efficientmanagement of state words between rounds, almost any intra-operandand/or inter-operand rearrangement of the differently-typed state wordsis possible. For example, it may still be beneficial to maintain thesame order of the differently-typed state words in the source and resultoperands.

In some embodiments, for example when only four state words are updatedby two rounds (e.g., A_(j+2), B_(j+2), E_(j+2), F_(j+2)), these updatedfour state words may optionally be written over four differently-typedstate words in one of the source operands, although this is notrequired. For example, A_(j+2), B_(j+2), E_(j+2), F_(j+2) may be writtenover C_(j+2), D_(j+2), G_(j+2), H_(j+2) instead of over A_(j), B_(j),E_(j), F_(j)). For example, the instruction may have asource/destination operand that is explicitly specified once, but isimplicitly understood to be used as both a source operand andsubsequently as a destination operand. Writing A_(j+2), B_(j+2),E_(j+2), F_(j+2) over C_(j), D_(j), G_(j), H_(j) instead of over A_(j),B_(j), E_(j), F_(j) may offer an advantage, for example when it'sdesired not to have another specified or implicitly indicated operandstorage location, of preserving A_(j), B_(j), E_(j), F_(j) so that theymay be used to update the remaining four state words by two rounds(e.g., C_(j+2), D_(j+2), G_(j+2), H_(j+2)). For example, an additionalSM3 acceleration instruction may be used (see e.g., FIG. 6), or this maybe done in software.

One particular example embodiment of an SM3 two round four state wordupdate instruction is the following SM3RNDS2 instruction. SRC representsa first 128-bit source operand, DST represents a second 128-bitsource/destination operand (one location is specified and use as both asource and again as a destination is implicit to instruction), <XMM0>represents a third 128-bit source operand whose location is implicit tothe instruction instead of being explicitly specified, and immrepresents an immediate (e.g., an 8-bit immediate) to specify the roundnumber (j). In other embodiments <XMM0> may be substituted for another128-bit register.

SM3RNDS2 DST, SRC, imm, <XMM0>

j=imm

[C_(j), D_(j), G_(j), H_(j)]=DST

[A_(j), B_(j), E_(j), F_(j)]=SRC

[W_(j+5), W_(j+4), W_(j+1), W_(j)]=XMM0

In response to the SM3RNDS2 instruction, a processor and/or an executionunit may perform the following operations, or their equivalent, or atleast generate a result consistent with these operations:

If(j<16), then T_(j)=0x79cc4519, else T_(j)=0x7a879d8a, endif

SS1=((A_(j)<<<12)+E_(j)+(T_(j)<<<j))<<<7

SS2=SS1 XOR (A_(j)<<<12)

TT1=FF_(j)(A_(j),B_(j),C_(j))+D_(j)+SS2+(W_(j) XOR W_(j+4))

TT2=GG_(j)(E_(j),F_(j),G_(j))+H_(j)+SS1+W_(j)

D_(j+1)=C_(j)

C_(j+1)=B_(j)<<<9

B_(j+1)=A_(j)

A_(j+1)=TT1

H_(j)+I=G_(j)

G_(j+1)=F_(j)<<<19

F_(j+1)=E_(j)

E_(j+1)=P0(TT2)

SS1=((A_(j+1)<<<12)+E_(j+1)+(T_(j)<<<(j+1)))<<<7

SS2=SS1 XOR (A+₁<<<12)

TT1=FF_(j+1)(A_(j+1),B_(j+1),C_(j)+)+D_(j+1)+SS2+(W_(j+1) XOR W_(j+5))

TT2=GG_(j+1)(E_(j+1),F_(j+1),G_(j+1))+H_(j+1)+SS1+W_(j+1)

B_(j+2)=A_(j+1)

A_(j+2)=TT1

F_(j+2)=E_(j+1)

E_(j+2)=P0(TT2)

DST=[A_(j+2), B_(j+2), E_(j+2), F_(j+2])

Notice that, for the second round, it is not required to calculateC_(j+2), D_(j+2), G_(j+2), H_(j+2) and these calculations may optionallybe omitted if desired from the second round. Accordingly, two fullrounds need not be performed, and it is to be appreciated that referenceherein to two rounds encompasses such operations optionally be removedfrom the second of the two rounds.

It is to be appreciated that this is just one illustrative example.Other embodiments may use different numbers and sizes of operands, aspreviously described. Moreover, other embodiments may rearrange theelements variously within the operands. Both inter-operand andintra-operand rearrangements are possible. In addition, it is notrequired to use implicit reuse of a SRC/DST register, or to use animplicit register (e.g., <XMM0>). For example, the architecture mayallow the operands to be specified explicitly, implicit subsequentregisters may be used, etc.

FIG. 6 is a block diagram illustrating an embodiment of an SM3 two roundfour remaining state word update operation 644 that may be performed inresponse to an embodiment of an SM3 two round four remaining state wordupdate instruction. In the illustrated embodiment, the instructionspecifies or otherwise indicates a source packed data operand 646. Asshown, in some embodiments, the source packed data operand may be a128-bit operand. Alternatively, two 64-bit operands, a 256-bit operand,or other sized operands may optionally be used instead. In someembodiments, the source packed data operand may have four state words tobe input to the current round (j) as input. For example, in theillustrated embodiment, the source packed data operand has, from a leastsignificant bit position on the right to a most significant bit positionon the left, the 32-bit state elements A_(j) in bits [31:0], B_(j) inbits [63:32], E_(j) in bits [95:64], and F_(j) in bits [127:96]. Inother embodiments, these elements may be apportioned among any desirednumber of source operands and in any desired order within the sourceoperand(s). For example, a reverse order within the operand mayoptionally be used. Moreover, in still other embodiments, the statewords may optionally be rearranged variously within a single sourceoperand or two source operands. In one aspect, the source packed dataoperand 646 may be the same operand/data as the first source packed dataoperand 530 of FIG. 5 (e.g., the operand/data may be reused by thealgorithm).

A result packed data operand 648 may be generated (e.g., by an executionunit 624) and stored in a destination storage location in response tothe instruction/operation. The destination storage location may bespecified or otherwise indicated by the instruction. In variousembodiments, the destination storage location may be a packed dataregister, a memory location, or other storage location. As shown, insome embodiments, the result packed data operand may be a 128-bitoperand. Alternatively, two 64-bit operands, a 256-bit operand, or othersized operands may optionally be used. In some embodiments, the resultpacked data operand 648 may include the four remaining state wordsupdated by two rounds. In one aspect, the four remaining state words mayrepresent those not included in the first result packed data operand 536stored in response to an SM3 two round four state word updateinstruction. In another aspect, the four remaining state words mayrepresent the four types of state words (e.g., C, D, G, and H-types) notincluded in the source packed data operand 646 (e.g., A, B, E, andF-types). As shown, in the illustrated embodiment, the result packeddata operand 648 has, the 32-bit state elements C_(j+2) in bits [31:0],D_(j+2) in bits [63:32], G_(j+2) in bits [95:64], and H_(j+2) in bits[127:96]. In other embodiments, a reverse order may optionally be used.Moreover, although the illustrated arrangement may offer certainadvantages, in still other embodiments, the state words may optionallybe rearranged variously within the result packed data operand.

In some embodiments, a processor and/or the execution unit 624 mayperform the following equations to generate C_(j+2), D_(j+2), G_(j+2)and H_(j+2), respectively, from A_(j), B_(j), E_(j) and F_(j) (providedin the source operand):

C_(j+2)=B_(j+1)=A_(j)<<<9

D_(j+2)=C_(j+1)=B_(j)<<<9

G_(j+2)=F_(j+1)<<<19=E_(j)<<<19

H_(j+2)=G_(j+1)=F_(j)<<<19

These relations can be readily derived from comparing the equalities fortwo rounds of the SM3 algorithm as shown in FIG. 2.

Recall that, as discussed above for FIG. 2 and Equations 4-6, the SM3algorithm utilizes messages (W_(j)). Messages W₀ to W₁₅ are obtainedfrom the 512-bit block being compressed. The remaining messages arecalculated based on Equations 4-6. Conventionally, the message expansiongenerally tends to involve executing a large number of separateinstructions. For example, conventionally it is possible that a separateinstruction may be used for each XOR operation, for each rotateoperation, etc. Additional instructions may also potentially be neededto move or rearrange data to prepare it for expanding more messages. Inaddition, a large number of such W_(j) messages need to be generated(e.g., W₁₆ to W₆₇). As a result, the performance of the rounds insoftware by separate more general-purpose instructions tends to be poorand/or take a significant amount of time.

In some embodiments, a pair of instructions to accelerate SM3 messageexpansion (e.g., instructions 108, 110) may be included in aninstruction set of a processor. In some embodiments, the instructionsmay be used to generate four new messages (e.g., messages W_(j+16),W_(j+17), W_(j+18), and W_(j+19)) corresponding to four sequential andconsecutive rounds. The pair of instructions may be included whether ornot the instruction set also includes an SM3 two round at least fourstate word update instruction (e.g., instruction 104).

In some embodiments, the source operands of the pair of instructions maycollectively include a set of messages sufficient to generate the fournew messages. The set of input messages needed to generate these fournew messages are shown in the following four instances of Equation 4, asfollows:

W_(j+16)=P1(W_(j) XOR W_(j+7) XOR (W_(j+13)<<<15)) XOR (W_(j+3)<<<7) XORW_(j+10)

W_(j+17)=P1(W_(j+1) XOR W_(j+8) XOR (W_(j+14)<<<15)) XOR (W_(j+4)<<<7)XOR W_(j+11)

W_(j+18)=P1(W_(j+2) XOR W_(j+9) XOR (W_(j+15)<<<15)) XOR (W_(j+5)<<<7)XOR W_(j+12)

W_(j+19)=P1(W_(j+3) XOR W_(j+10) XOR (W_(j+16)<<<15)) XOR (W_(j+6)<<<7)XOR W_(j+13)

Sixteen unique messages are needed to evaluate these relations for thefour new messages (e.g., W_(j) through W_(j+15)). In addition, themessage W_(j+16) needs to be calculated to complete the calculation ofW_(j+19). W_(j) corresponds to the oldest round to be input to round j,W_(j+1) corresponds to the next oldest round to be input to round (j+1),and so on.

In one embodiment, all sixteen unique messages (e.g., W_(j) to W_(j+15))may optionally be included in the source operand(s) of one singleinstruction. The one single instruction may be operable to cause theprocessor to store all four updated messages (e.g., W_(j+16) toW_(j+19)) within the confines of the execution of that singleinstruction. In other embodiments, a pair of instructions may be used,and the sixteen unique messages (e.g., W_(j) to W_(j+15)) may becollectively included in the source operand(s) of the pair ofinstructions. The pair of instructions in cooperation may be operable tocause the processor to store all four updated messages (e.g., W_(j+16)to W_(j+19)) within the confines of the execution of the pair ofinstructions. Each of the two instructions may provide only a subset ofthe needed input messages through its corresponding source operand(s). Afirst/initial instruction of the pair may generate temporary resultsthat are further processed by the second/subsequent instruction togenerate the four new messages. Using a pair of instructions, instead ofa single instruction, may offer certain potential advantages, forexample, allowing the use of smaller registers and/or a smaller numberof source operands than would be needed to provide all needed inputmessages in the source operand(s) of one single instruction.

FIGS. 7-8 illustrate operations for an embodiment of a pair of SM3message expansion instructions. The instructions may be received,decoded, an execution unit may be enabled to perform the operations,etc., as previously described. FIG. 7 is a block diagram illustrating anembodiment of an SM3 four message expansion initiation operation 750that may be performed in response to an embodiment of an SM3 fourmessage expansion initiation instruction (e.g., a first instruction ofthe pair to be performed). In the illustrated embodiment, theinstruction specifies or otherwise indicates a first 128-bit sourcepacked data operand 752, a second 128-bit source packed data operand754, and a third 128-bit source packed data operand 756. As before, theuse of 128-bit operands may offer certain advantages, but is notrequired. In other embodiments, different numbers and sizes of operandsmay optionally be used, such as, for example, 64-bit operands, 256-bitoperands, a combination of different sized operands, etc.

The first, second, and third source operands may be used to provide onlya subset of the sixteen different input messages needed to evaluate thefour new messages. In one aspect, the messages provided may representthose sufficient to evaluate a piece or portion of each of the fourinstances of Equation 4 shown immediately above. For example, in theillustrated example embodiment, the first source operand 752 has, themessages W_(j) in bits [31:0], W_(j+1) in bits [63:32], W_(j+2) in bits[95:64], and W_(j+3) in bits [127:96]. The second source operand 754has, the messages W_(j+13) in bits [31:0], W_(j+14) in bits [63:32],W_(j+15) in bits [95:64], and a do-not-care value (*) in bits [127:96].The do-not-care value (*) may represent various convenient values, suchas, for example, all zeroes, all ones, existing/unchanged bit values,etc. The third source operand 756 has, the messages W_(j+7) in bits[31:0], W_(j+8) in bits [63:32], W_(j+9) in bits [95:64], and W_(j+10)in bits [127:96].

In the illustrated embodiment, the first source operand 752 optionallyhas four messages corresponding to four consecutive rounds, andoptionally arranged according to round order (e.g., ascending roundorder with increasing bit significance). Likewise, the second sourceoperand 754 optionally has three messages corresponding to threeconsecutive rounds, and optionally arranged according to round order(e.g., ascending round order). Similarly, the third source operand 756optionally has four messages corresponding to four consecutive rounds,and optionally arranged according to (e.g., ascending) round order. Inanother embodiment, a reverse or reflected order of the messages withinin the operands may optionally be used if desired (e.g., the messagesmay be arranged in descending order within each of the operands).Storing messages for adjacent rounds within the same operand, storingmessages for adjacent rounds in round order within the operands, andstoring the adjacent messages of each of the operands in the same roundorder (e.g., all arranged in ascending round order), may help toincrease the efficiency of managing the rearrangement of messagesbetween rounds, but is not required. In other embodiments, the messagesmay optionally be rearranged through various intra-operand and/orinter-operand rearrangements. Moreover, in other embodiments, othernumbers and/or sizes of operands may optionally be used, if desired.

Referring again to FIG. 7, a result packed data operand 758 may begenerated (e.g., by an execution unit 724) and stored in a destinationstorage location in response to the SM3 four message expansioninitiation instruction/operation. The destination storage location maybe specified or otherwise indicated by the instruction. The destinationstorage location may be a packed data register, a memory location, orother storage location. In some embodiments, the result packed dataoperand 758 may include four temporary or intermediate results, forexample, each representing a different evaluated piece/portion of acorresponding one of the four instances of Equation 4 shown immediatelyabove. As used herein, an evaluated piece/portion means a valueconsistent with an evaluated piece/portion not necessarily that eachoperation shown in the equations be performed or even that thoseequations are actually used. For example, in other embodiments,computationally equivalent equations or portions thereof (e.g.,computationally equivalent operations) may be derived and substitutedfor the equations shown herein.

Referring again to FIG. 7, in the illustrated embodiment, the resultpacked data operand 758 has, a first 32-bit temporary result (W_(TMP0))in bits [31:0], W_(TMP1) in bits [63:32], W_(TMP2) in bits [95:64], andW_(TMP3) in bits [127:96]. In some embodiments, W_(TMP0)-W_(TMP3) may beequivalent to the following calculations being performed by theprocessor:

T0=W_(j) XOR W_(j+7) XOR (W_(j+13)<<<15)

T1=W_(j+1) XOR W_(j+8) XOR (W_(j+14)<<<15)

T2=W_(j+2) XOR W_(j+9) XOR (W_(j+15)<<<15)

T3=W_(j+3) XOR W_(j+10)

W_(TMP0)=P1(T0)

W_(TMP1)=P1(T1)

W_(TMP2)=P1(T2)

W_(TMP3)=P1(T3)

In one particular embodiment, the first source operand 752 be in animplicitly indicated 128-bit source register, the second source operand754 may be in an explicitly specified 128-bit source register, the thirdsource operand 756 may be in an explicitly specified 128-bitsource/destination register, and the result operand 758 may be writtenover the third source operand 756 in the source/destination register,although the scope of the invention is not so limited.

FIG. 8 is a block diagram illustrating an embodiment of an SM3 fourmessage expansion completion operation 860 that may be performed inresponse to an embodiment of an SM3 four message expansion completioninstruction. In the illustrated embodiment, the instruction specifies orotherwise indicates a first 128-bit source packed data operand 862, asecond 128-bit source packed data operand 864, and a third 128-bitsource packed data operand 866. As before, the use of 128-bit operandsmay offer certain advantages, for example allowing use of theinstructions in processors that have 128-bit packed data registers butnot 256-bit packed data registers, but is not required. In otherembodiments, different numbers and sizes of operands may optionally beused, such as, for example, 64-bit operands, 256-bit operands, acombination of different sized operands, etc.

The first, second, and third source operands may be used to provide aremaining complementary subset of the sixteen different messages neededto generate the four new messages for the four sequential andconsecutive rounds. In some embodiments, the messages may representthose sufficient to evaluate remaining pieces/portions of the fourinstances of Equation 4 not evaluated by the instruction/operation ofFIG. 7. For example, in the illustrated embodiment, the first sourceoperand 862 has, the 32-bit message W_(j+10) in bits [31:0], the messageW_(j+11) in bits [63:32], the message W_(j+12) in bits [95:64], and themessage W_(j+13) in bits [127:96]. The second source operand 864 has,the message W_(j+3) in bits [31:0], the message W_(j+4) in bits [63:32],the message W_(j+5) in bits [95:64], and the message W_(j+6) in bits[127:96]. The third source operand 866 has, the first temporary result(W_(TMP0)) in bits [31:0], the second temporary result (W_(TMP1)) inbits [63:32], the third temporary result (W_(TMP2)) in bits [95:64], andthe fourth temporary result (W_(TMP3)) in bits [127:96]. In one aspect,the third source packed data operand 866 may optionally be the sameoperand as the result packed data operand 758.

In the illustrated embodiment, the first source operand 862 optionallyhas four messages corresponding to four consecutive rounds, andoptionally arranged according to round order (e.g., ascending roundorder with increasing bit significance). Likewise, the second sourceoperand 864 optionally has four messages corresponding to threeconsecutive rounds, and optionally arranged according to round order(e.g., ascending round order). The third source operand 866 optionallyhas four temporary results W_(TMP0) to W_(TPM3). In another embodiment,a reverse or reflected order of the messages within in the operands mayoptionally be used if desired (e.g., the messages may be arranged indescending order within each of the operands). Storing messages foradjacent rounds within the same operand, storing messages for adjacentrounds in round order within the operands, and storing the adjacentmessages of each of the operands in the same round order (e.g., allarranged in ascending round order), may help to increase the efficiencyof managing the rearrangement of messages between rounds, but is notrequired. In other embodiments, the messages and/or the temporaryresults (W_(TMP0) to W_(TMP3)) may optionally be rearranged throughvarious intra-operand and/or inter-operand rearrangements. Moreover, inother embodiments, other numbers and/or sizes of operands may optionallybe used, if desired.

Referring again to FIG. 8, a result packed data operand 868 may begenerated (e.g., by an execution unit 824) and stored in a destinationstorage location in response to the SM3 four message expansioncompletion instruction/operation. The destination storage location maybe specified or otherwise indicated by the instruction. The destinationstorage location may be a packed data register, a memory location, orother storage location. In some embodiments, the result packed dataoperand 868 may include four messages for four sequential andconsecutive rounds. As shown, in the illustrated embodiment, the resultpacked data operand 868 has, a first 32-bit message W_(j+16) to be inputto round (j+16) of the compression function of the SM3 hash function inbits [31:0], a second 32-bit message W_(j+17) to be input to round(j+17) in bits [63:32], a third 32-bit message W_(j+18) to be input toround (j+18) in bits [95:64], and a fourth 32-bit message W_(j+19) to beinput to round (j+19) in bits [127:96].

In some embodiments, W_(j+16) to W_(j+19) may be evaluated to beconsistent with the following operations:

W_(j+16)=(W_(j+3)<<<7) XOR W_(j+10) XOR W_(TMP0)

W_(j+17)=(W_(j+4)<<<7) XOR W_(j+11) XOR W_(TMP1)

W_(j+18)=(W_(j+5)<<<7) XOR W_(j+12) XOR W_(TMP2)

W_(j+19)=(W_(j+6)<<<7) XOR W_(j+13) XOR W_(TMP3)

W_(j+19)=W_(j+19) XOR (W_(j+16)<<<6) XOR (W_(j+16)<<<15) XOR(W_(j+16)<<<30)

Notice W_(j+16) is calculated and then used to complete the evaluationof W_(j+19). Advantageously, this pair of SM3 message expansionoperations/instructions may significantly help to increase the speed,efficiency, and/or performance of implementing the SM3 messagegeneration (e.g., by avoiding an otherwise high instruction count andcomplexity through conventional software approaches). It is to beappreciated that this is just one illustrative example of a suitablepair of instructions.

In other embodiments, other pieces of the four instances of Equation 4shown above may optionally be evaluated by the first instruction of thepair and the remaining pieces may be evaluated by the second subsequentinstruction. Correspondingly, different subsets of the messages may beprovided by the first instruction of the pair versus those provided bythe second instruction of the pair. That is, there is flexibility inapportioning the messages between the first and second instructions aslong as the messages provided can be used to evaluate pieces of theinstances of Equation 4 that can be passed as intermediate results fromthe first instruction to the second subsequent instruction which may usethem and the remaining not yet provided messages to complete theevaluations of these instances of Equation 4.

In one particular embodiment, the first source operand 862 may be in animplicitly indicated 128-bit source register, the second source operand864 may be in an explicitly specified 128-bit source register, the thirdsource operand 866 may be in an explicitly specified 128-bitsource/destination register, and the result operand 868 may be writtenover the third source operand 866 in the source/destination register,although the scope of the invention is not so limited.

The instructions and processors described here are intended to implementthe SM3 Chinese cryptographic hash function and obtain values that areconsistent therewith. Any possible discrepancies or inconsistencies inthe description (e.g., due to typographical errors, translation errors,errors in the description, or otherwise) that would lead to resultsinconsistent with the SM4 algorithm are unintentional and erroneous. Inaddition, while the current version of the SM3 algorithm has beendescribed, it is to be appreciated that embodiments are also applicableto extensions of this standard (e.g., SMx Chinese cryptographic hashstandards where SMx represents a future version of SM3), derivations ofthis standard, modifications of this standard, related standards, andthe like, which meet the limitations of the claims. As used herein, SM3refers to the described and known algorithm regardless of whether it iscalled SM3, or some other name.

Exemplary Core Architectures, Processors, and Computer Architectures

Processor cores may be implemented in different ways, for differentpurposes, and in different processors. For instance, implementations ofsuch cores may include: 1) a general purpose in-order core intended forgeneral-purpose computing; 2) a high performance general purposeout-of-order core intended for general-purpose computing; 3) a specialpurpose core intended primarily for graphics and/or scientific(throughput) computing. Implementations of different processors mayinclude: 1) a CPU including one or more general purpose in-order coresintended for general-purpose computing and/or one or more generalpurpose out-of-order cores intended for general-purpose computing; and2) a coprocessor including one or more special purpose cores intendedprimarily for graphics and/or scientific (throughput). Such differentprocessors lead to different computer system architectures, which mayinclude: 1) the coprocessor on a separate chip from the CPU; 2) thecoprocessor on a separate die in the same package as a CPU; 3) thecoprocessor on the same die as a CPU (in which case, such a coprocessoris sometimes referred to as special purpose logic, such as integratedgraphics and/or scientific (throughput) logic, or as special purposecores); and 4) a system on a chip that may include on the same die thedescribed CPU (sometimes referred to as the application core(s) orapplication processor(s)), the above described coprocessor, andadditional functionality. Exemplary core architectures are describednext, followed by descriptions of exemplary processors and computerarchitectures.

Exemplary Core Architectures In-Order and Out-of-Order Core BlockDiagram

FIG. 9A is a block diagram illustrating both an exemplary in-orderpipeline and an exemplary register renaming, out-of-orderissue/execution pipeline according to embodiments of the invention. FIG.9B is a block diagram illustrating both an exemplary embodiment of anin-order architecture core and an exemplary register renaming,out-of-order issue/execution architecture core to be included in aprocessor according to embodiments of the invention. The solid linedboxes in FIGS. 9A-B illustrate the in-order pipeline and in-order core,while the optional addition of the dashed lined boxes illustrates theregister renaming, out-of-order issue/execution pipeline and core. Giventhat the in-order aspect is a subset of the out-of-order aspect, theout-of-order aspect will be described.

Exemplary Core Architectures

In-order and out-of-order core block diagram In FIG. 9A, a processorpipeline 900 includes a fetch stage 902, a length decode stage 904, adecode stage 906, an allocation stage 908, a renaming stage 910, ascheduling (also known as a dispatch or issue) stage 912, a registerread/memory read stage 914, an execute stage 916, a write back/memorywrite stage 918, an exception handling stage 922, and a commit stage924.

FIG. 9B shows processor core 990 including a front end unit 930 coupledto an execution engine unit 950, and both are coupled to a memory unit970. The core 990 may be a reduced instruction set computing (RISC)core, a complex instruction set computing (CISC) core, a very longinstruction word (VLIW) core, or a hybrid or alternative core type. Asyet another option, the core 990 may be a special-purpose core, such as,for example, a network or communication core, compression engine,coprocessor core, general purpose computing graphics processing unit(GPGPU) core, graphics core, or the like.

The front end unit 930 includes a branch prediction unit 932 coupled toan instruction cache unit 934, which is coupled to an instructiontranslation lookaside buffer (TLB) 936, which is coupled to aninstruction fetch unit 938, which is coupled to a decode unit 940. Thedecode unit 940 (or decoder) may decode instructions, and generate as anoutput one or more micro-operations, micro-code entry points,microinstructions, other instructions, or other control signals, whichare decoded from, or which otherwise reflect, or are derived from, theoriginal instructions. The decode unit 940 may be implemented usingvarious different mechanisms. Examples of suitable mechanisms include,but are not limited to, look-up tables, hardware implementations,programmable logic arrays (PLAs), microcode read only memories (ROMs),etc. In one embodiment, the core 990 includes a microcode ROM or othermedium that stores microcode for certain macroinstructions (e.g., indecode unit 940 or otherwise within the front end unit 930). The decodeunit 940 is coupled to a rename/allocator unit 952 in the executionengine unit 950.

The execution engine unit 950 includes the rename/allocator unit 952coupled to a retirement unit 954 and a set of one or more schedulerunit(s) 956. The scheduler unit(s) 956 represents any number ofdifferent schedulers, including reservations stations, centralinstruction window, etc. The scheduler unit(s) 956 is coupled to thephysical register file(s) unit(s) 958. Each of the physical registerfile(s) units 958 represents one or more physical register files,different ones of which store one or more different data types, such asscalar integer, scalar floating point, packed integer, packed floatingpoint, vector integer, vector floating point, status (e.g., aninstruction pointer that is the address of the next instruction to beexecuted), etc. In one embodiment, the physical register file(s) unit958 comprises a vector registers unit, a write mask registers unit, anda scalar registers unit. These register units may provide architecturalvector registers, vector mask registers, and general purpose registers.The physical register file(s) unit(s) 958 is overlapped by theretirement unit 954 to illustrate various ways in which registerrenaming and out-of-order execution may be implemented (e.g., using areorder buffer(s) and a retirement register file(s); using a futurefile(s), a history buffer(s), and a retirement register file(s); using aregister maps and a pool of registers; etc.). The retirement unit 954and the physical register file(s) unit(s) 958 are coupled to theexecution cluster(s) 960. The execution cluster(s) 960 includes a set ofone or more execution units 962 and a set of one or more memory accessunits 964. The execution units 962 may perform various operations (e.g.,shifts, addition, subtraction, multiplication) and on various types ofdata (e.g., scalar floating point, packed integer, packed floatingpoint, vector integer, vector floating point). While some embodimentsmay include a number of execution units dedicated to specific functionsor sets of functions, other embodiments may include only one executionunit or multiple execution units that all perform all functions. Thescheduler unit(s) 956, physical register file(s) unit(s) 958, andexecution cluster(s) 960 are shown as being possibly plural becausecertain embodiments create separate pipelines for certain types ofdata/operations (e.g., a scalar integer pipeline, a scalar floatingpoint/packed integer/packed floating point/vector integer/vectorfloating point pipeline, and/or a memory access pipeline that each havetheir own scheduler unit, physical register file(s) unit, and/orexecution cluster—and in the case of a separate memory access pipeline,certain embodiments are implemented in which only the execution clusterof this pipeline has the memory access unit(s) 964). It should also beunderstood that where separate pipelines are used, one or more of thesepipelines may be out-of-order issue/execution and the rest in-order.

The set of memory access units 964 is coupled to the memory unit 970,which includes a data TLB unit 972 coupled to a data cache unit 974coupled to a level 2 (L2) cache unit 976. In one exemplary embodiment,the memory access units 964 may include a load unit, a store addressunit, and a store data unit, each of which is coupled to the data TLBunit 972 in the memory unit 970. The instruction cache unit 934 isfurther coupled to a level 2 (L2) cache unit 976 in the memory unit 970.The L2 cache unit 976 is coupled to one or more other levels of cacheand eventually to a main memory.

By way of example, the exemplary register renaming, out-of-orderissue/execution core architecture may implement the pipeline 900 asfollows: 1) the instruction fetch 938 performs the fetch and lengthdecoding stages 902 and 904; 2) the decode unit 940 performs the decodestage 906; 3) the rename/allocator unit 952 performs the allocationstage 908 and renaming stage 910; 4) the scheduler unit(s) 956 performsthe schedule stage 912; 5) the physical register file(s) unit(s) 958 andthe memory unit 970 perform the register read/memory read stage 914; theexecution cluster 960 perform the execute stage 916; 6) the memory unit970 and the physical register file(s) unit(s) 958 perform the writeback/memory write stage 918; 7) various units may be involved in theexception handling stage 922; and 8) the retirement unit 954 and thephysical register file(s) unit(s) 958 perform the commit stage 924.

The core 990 may support one or more instructions sets (e.g., the x86instruction set (with some extensions that have been added with newerversions); the MIPS instruction set of MIPS Technologies of Sunnyvale,Calif.; the ARM instruction set (with optional additional extensionssuch as NEON) of ARM Holdings of Sunnyvale, Calif.), including theinstruction(s) described herein. In one embodiment, the core 990includes logic to support a packed data instruction set extension (e.g.,AVX1, AVX2), thereby allowing the operations used by many multimediaapplications to be performed using packed data.

It should be understood that the core may support multithreading(executing two or more parallel sets of operations or threads), and maydo so in a variety of ways including time sliced multithreading,simultaneous multithreading (where a single physical core provides alogical core for each of the threads that physical core issimultaneously multithreading), or a combination thereof (e.g., timesliced fetching and decoding and simultaneous multithreading thereaftersuch as in the Intel® Hyperthreading technology).

While register renaming is described in the context of out-of-orderexecution, it should be understood that register renaming may be used inan in-order architecture. While the illustrated embodiment of theprocessor also includes separate instruction and data cache units934/974 and a shared L2 cache unit 976, alternative embodiments may havea single internal cache for both instructions and data, such as, forexample, a Level 1 (L) internal cache, or multiple levels of internalcache. In some embodiments, the system may include a combination of aninternal cache and an external cache that is external to the core and/orthe processor. Alternatively, all of the cache may be external to thecore and/or the processor.

Specific Exemplary in-Order Core Architecture

FIGS. 10A-B illustrate a block diagram of a more specific exemplaryin-order core architecture, which core would be one of several logicblocks (including other cores of the same type and/or different types)in a chip. The logic blocks communicate through a high-bandwidthinterconnect network (e.g., a ring network) with some fixed functionlogic, memory I/O interfaces, and other necessary I/O logic, dependingon the application.

FIG. 10A is a block diagram of a single processor core, along with itsconnection to the on-die interconnect network 1002 and with its localsubset of the Level 2 (L2) cache 1004, according to embodiments of theinvention. In one embodiment, an instruction decoder 1000 supports thex86 instruction set with a packed data instruction set extension. An Lcache 1006 allows low-latency accesses to cache memory into the scalarand vector units. While in one embodiment (to simplify the design), ascalar unit 1008 and a vector unit 1010 use separate register sets(respectively, scalar registers 1012 and vector registers 1014) and datatransferred between them is written to memory and then read back in froma level 1 (L) cache 1006, alternative embodiments of the invention mayuse a different approach (e.g., use a single register set or include acommunication path that allow data to be transferred between the tworegister files without being written and read back).

The local subset of the L2 cache 1004 is part of a global L2 cache thatis divided into separate local subsets, one per processor core. Eachprocessor core has a direct access path to its own local subset of theL2 cache 1004. Data read by a processor core is stored in its L2 cachesubset 1004 and can be accessed quickly, in parallel with otherprocessor cores accessing their own local L2 cache subsets. Data writtenby a processor core is stored in its own L2 cache subset 1004 and isflushed from other subsets, if necessary. The ring network ensurescoherency for shared data. The ring network is bi-directional to allowagents such as processor cores, L2 caches and other logic blocks tocommunicate with each other within the chip. Each ring data-path is1012-bits wide per direction.

FIG. 10B is an expanded view of part of the processor core in FIG. 10Aaccording to embodiments of the invention. FIG. 10B includes an L1 datacache 1006A part of the L1 cache 1004, as well as more detail regardingthe vector unit 1010 and the vector registers 1014. Specifically, thevector unit 1010 is a 16-wide vector processing unit (VPU) (see the16-wide ALU 1028), which executes one or more of integer,single-precision float, and double-precision float instructions. The VPUsupports swizzling the register inputs with swizzle unit 1020, numericconversion with numeric convert units 1022A-B, and replication withreplication unit 1024 on the memory input. Write mask registers 1026allow predicating resulting vector writes.

Processor with Integrated Memory Controller and Graphics

FIG. 11 is a block diagram of a processor 1100 that may have more thanone core, may have an integrated memory controller, and may haveintegrated graphics according to embodiments of the invention. The solidlined boxes in FIG. 11 illustrate a processor 1100 with a single core1102A, a system agent 1110, a set of one or more bus controller units1116, while the optional addition of the dashed lined boxes illustratesan alternative processor 1100 with multiple cores 1102A-N, a set of oneor more integrated memory controller unit(s) 1114 in the system agentunit 1110, and special purpose logic 1108.

Thus, different implementations of the processor 1100 may include: 1) aCPU with the special purpose logic 1108 being integrated graphics and/orscientific (throughput) logic (which may include one or more cores), andthe cores 1102A-N being one or more general purpose cores (e.g., generalpurpose in-order cores, general purpose out-of-order cores, acombination of the two); 2) a coprocessor with the cores 1102A-N being alarge number of special purpose cores intended primarily for graphicsand/or scientific (throughput); and 3) a coprocessor with the cores1102A-N being a large number of general purpose in-order cores. Thus,the processor 1100 may be a general-purpose processor, coprocessor orspecial-purpose processor, such as, for example, a network orcommunication processor, compression engine, graphics processor, GPGPU(general purpose graphics processing unit), a high-throughput manyintegrated core (MIC) coprocessor (including 30 or more cores), embeddedprocessor, or the like. The processor may be implemented on one or morechips. The processor 1100 may be a part of and/or may be implemented onone or more substrates using any of a number of process technologies,such as, for example, BiCMOS, CMOS, or NMOS.

The memory hierarchy includes one or more levels of cache within thecores, a set or one or more shared cache units 1106, and external memory(not shown) coupled to the set of integrated memory controller units1114. The set of shared cache units 1106 may include one or moremid-level caches, such as level 2 (L2), level 3 (L3), level 4 (L4), orother levels of cache, a last level cache (LLC), and/or combinationsthereof. While in one embodiment a ring based interconnect unit 1112interconnects the integrated graphics logic 1108, the set of sharedcache units 1106, and the system agent unit 1110/integrated memorycontroller unit(s) 1114, alternative embodiments may use any number ofwell-known techniques for interconnecting such units. In one embodiment,coherency is maintained between one or more cache units 1106 and cores1102-A-N.

In some embodiments, one or more of the cores 1102A-N are capable ofmultithreading. The system agent 1110 includes those componentscoordinating and operating cores 1102A-N. The system agent unit 1110 mayinclude for example a power control unit (PCU) and a display unit. ThePCU may be or include logic and components needed for regulating thepower state of the cores 1102A-N and the integrated graphics logic 1108.The display unit is for driving one or more externally connecteddisplays.

The cores 1102A-N may be homogenous or heterogeneous in terms ofarchitecture instruction set; that is, two or more of the cores 1102A-Nmay be capable of execution the same instruction set, while others maybe capable of executing only a subset of that instruction set or adifferent instruction set.

Exemplary Computer Architectures

FIGS. 12-15 are block diagrams of exemplary computer architectures.Other system designs and configurations known in the arts for laptops,desktops, handheld PCs, personal digital assistants, engineeringworkstations, servers, network devices, network hubs, switches, embeddedprocessors, digital signal processors (DSPs), graphics devices, videogame devices, set-top boxes, micro controllers, cell phones, portablemedia players, hand held devices, and various other electronic devices,are also suitable. In general, a huge variety of systems or electronicdevices capable of incorporating a processor and/or other executionlogic as disclosed herein are generally suitable.

Referring now to FIG. 12, shown is a block diagram of a system 1200 inaccordance with one embodiment of the present invention. The system 1200may include one or more processors 1210, 1215, which are coupled to acontroller hub 1220. In one embodiment the controller hub 1220 includesa graphics memory controller hub (GMCH) 1290 and an Input/Output Hub(IOH) 1250 (which may be on separate chips); the GMCH 1290 includesmemory and graphics controllers to which are coupled memory 1240 and acoprocessor 1245; the IOH 1250 is couples input/output (I/O) devices1260 to the GMCH 1290. Alternatively, one or both of the memory andgraphics controllers are integrated within the processor (as describedherein), the memory 1240 and the coprocessor 1245 are coupled directlyto the processor 1210, and the controller hub 1220 in a single chip withthe IOH 1250.

The optional nature of additional processors 1215 is denoted in FIG. 12with broken lines. Each processor 1210, 1215 may include one or more ofthe processing cores described herein and may be some version of theprocessor 1100.

The memory 1240 may be, for example, dynamic random access memory(DRAM), phase change memory (PCM), or a combination of the two. For atleast one embodiment, the controller hub 1220 communicates with theprocessor(s) 1210, 1215 via a multi-drop bus, such as a frontside bus(FSB), point-to-point interface such as QuickPath Interconnect (QPI), orsimilar connection 1295.

In one embodiment, the coprocessor 1245 is a special-purpose processor,such as, for example, a high-throughput MIC processor, a network orcommunication processor, compression engine, graphics processor, GPGPU,embedded processor, or the like. In one embodiment, controller hub 1220may include an integrated graphics accelerator.

There can be a variety of differences between the physical resources1210, 1215 in terms of a spectrum of metrics of merit includingarchitectural, microarchitectural, thermal, power consumptioncharacteristics, and the like.

In one embodiment, the processor 1210 executes instructions that controldata processing operations of a general type. Embedded within theinstructions may be coprocessor instructions. The processor 1210recognizes these coprocessor instructions as being of a type that shouldbe executed by the attached coprocessor 1245. Accordingly, the processor1210 issues these coprocessor instructions (or control signalsrepresenting coprocessor instructions) on a coprocessor bus or otherinterconnect, to coprocessor 1245. Coprocessor(s) 1245 accept andexecute the received coprocessor instructions.

Referring now to FIG. 13, shown is a block diagram of a first morespecific exemplary system 1300 in accordance with an embodiment of thepresent invention. As shown in FIG. 13, multiprocessor system 1300 is apoint-to-point interconnect system, and includes a first processor 1370and a second processor 1380 coupled via a point-to-point interconnect1350. Each of processors 1370 and 1380 may be some version of theprocessor 1100. In one embodiment of the invention, processors 1370 and1380 are respectively processors 1210 and 1215, while coprocessor 1338is coprocessor 1245. In another embodiment, processors 1370 and 1380 arerespectively processor 1210 coprocessor 1245.

Processors 1370 and 1380 are shown including integrated memorycontroller (IMC) units 1372 and 1382, respectively. Processor 1370 alsoincludes as part of its bus controller units point-to-point (P-P)interfaces 1376 and 1378; similarly, second processor 1380 includes P-Pinterfaces 1386 and 1388. Processors 1370, 1380 may exchange informationvia a point-to-point (P-P) interface 1350 using P-P interface circuits1378, 1388. As shown in FIG. 13, IMCs 1372 and 1382 couple theprocessors to respective memories, namely a memory 1332 and a memory1334, which may be portions of main memory locally attached to therespective processors.

Processors 1370, 1380 may each exchange information with a chipset 1390via individual P-P interfaces 1352, 1354 using point to point interfacecircuits 1376, 1394, 1386, 1398. Chipset 1390 may optionally exchangeinformation with the coprocessor 1338 via a high-performance interface1339. In one embodiment, the coprocessor 1338 is a special-purposeprocessor, such as, for example, a high-throughput MIC processor, anetwork or communication processor, compression engine, graphicsprocessor, GPGPU, embedded processor, or the like.

A shared cache (not shown) may be included in either processor oroutside of both processors, yet connected with the processors via P-Pinterconnect, such that either or both processors' local cacheinformation may be stored in the shared cache if a processor is placedinto a low power mode.

Chipset 1390 may be coupled to a first bus 1316 via an interface 1396.In one embodiment, first bus 1316 may be a Peripheral ComponentInterconnect (PCI) bus, or a bus such as a PCI Express bus or anotherthird generation I/O interconnect bus, although the scope of the presentinvention is not so limited.

As shown in FIG. 13, various I/O devices 1314 may be coupled to firstbus 1316, along with a bus bridge 1318 which couples first bus 1316 to asecond bus 1320. In one embodiment, one or more additional processor(s)1315, such as coprocessors, high-throughput MIC processors, GPGPU's,accelerators (such as, e.g., graphics accelerators or digital signalprocessing (DSP) units), field programmable gate arrays, or any otherprocessor, are coupled to first bus 1316. In one embodiment, second bus1320 may be a low pin count (LPC) bus. Various devices may be coupled toa second bus 1320 including, for example, a keyboard and/or mouse 1322,communication devices 1327 and a storage unit 1328 such as a disk driveor other mass storage device which may include instructions/code anddata 1330, in one embodiment. Further, an audio I/O 1324 may be coupledto the second bus 1320. Note that other architectures are possible. Forexample, instead of the point-to-point architecture of FIG. 13, a systemmay implement a multi-drop bus or other such architecture.

Referring now to FIG. 14, shown is a block diagram of a second morespecific exemplary system 1400 in accordance with an embodiment of thepresent invention. Like elements in FIGS. 13 and 14 bear like referencenumerals, and certain aspects of FIG. 13 have been omitted from FIG. 14in order to avoid obscuring other aspects of FIG. 14.

FIG. 14 illustrates that the processors 1370, 1380 may includeintegrated memory and I/O control logic (“CL”) 1372 and 1382,respectively. Thus, the CL 1372, 1382 include integrated memorycontroller units and include I/O control logic. FIG. 14 illustrates thatnot only are the memories 1332, 1334 coupled to the CL 1372, 1382, butalso that I/O devices 1414 are also coupled to the control logic 1372,1382. Legacy I/O devices 1415 are coupled to the chipset 1390.

Referring now to FIG. 15, shown is a block diagram of a SoC 1500 inaccordance with an embodiment of the present invention. Similar elementsin FIG. 11 bear like reference numerals. Also, dashed lined boxes areoptional features on more advanced SoCs. In FIG. 15, an interconnectunit(s) 1502 is coupled to: an application processor 1510 which includesa set of one or more cores 202A-N and shared cache unit(s) 1106; asystem agent unit 1110; a bus controller unit(s) 1116; an integratedmemory controller unit(s) 1114; a set or one or more coprocessors 1520which may include integrated graphics logic, an image processor, anaudio processor, and a video processor; an static random access memory(SRAM) unit 1530; a direct memory access (DMA) unit 1532; and a displayunit 1540 for coupling to one or more external displays. In oneembodiment, the coprocessor(s) 1520 include a special-purpose processor,such as, for example, a network or communication processor, compressionengine, GPGPU, a high-throughput MIC processor, embedded processor, orthe like.

Embodiments of the mechanisms disclosed herein may be implemented inhardware, software, firmware, or a combination of such implementationapproaches. Embodiments of the invention may be implemented as computerprograms or program code executing on programmable systems comprising atleast one processor, a storage system (including volatile andnon-volatile memory and/or storage elements), at least one input device,and at least one output device.

Program code, such as code 1330 illustrated in FIG. 13, may be appliedto input instructions to perform the functions described herein andgenerate output information. The output information may be applied toone or more output devices, in known fashion. For purposes of thisapplication, a processing system includes any system that has aprocessor, such as, for example; a digital signal processor (DSP), amicrocontroller, an application specific integrated circuit (ASIC), or amicroprocessor.

The program code may be implemented in a high level procedural or objectoriented programming language to communicate with a processing system.The program code may also be implemented in assembly or machinelanguage, if desired. In fact, the mechanisms described herein are notlimited in scope to any particular programming language. In any case,the language may be a compiled or interpreted language.

One or more aspects of at least one embodiment may be implemented byrepresentative instructions stored on a machine-readable medium whichrepresents various logic within the processor, which when read by amachine causes the machine to fabricate logic to perform the techniquesdescribed herein. Such representations, known as “IP cores” may bestored on a tangible, machine readable medium and supplied to variouscustomers or manufacturing facilities to load into the fabricationmachines that actually make the logic or processor.

Such machine-readable storage media may include, without limitation,non-transitory, tangible arrangements of articles manufactured or formedby a machine or device, including storage media such as hard disks, anyother type of disk including floppy disks, optical disks, compact diskread-only memories (CD-ROMs), compact disk rewritable's (CD-RWs), andmagneto-optical disks, semiconductor devices such as read-only memories(ROMs), random access memories (RAMs) such as dynamic random accessmemories (DRAMs), static random access memories (SRAMs), erasableprogrammable read-only memories (EPROMs), flash memories, electricallyerasable programmable read-only memories (EEPROMs), phase change memory(PCM), magnetic or optical cards, or any other type of media suitablefor storing electronic instructions.

Accordingly, embodiments of the invention also include non-transitory,tangible machine-readable media containing instructions or containingdesign data, such as Hardware Description Language (HDL), which definesstructures, circuits, apparatuses, processors and/or system featuresdescribed herein. Such embodiments may also be referred to as programproducts.

Emulation (Including Binary Translation, Code Morphing, Etc.)

In some cases, an instruction converter may be used to convert aninstruction from a source instruction set to a target instruction set.For example, the instruction converter may translate (e.g., using staticbinary translation, dynamic binary translation including dynamiccompilation), morph, emulate, or otherwise convert an instruction to oneor more other instructions to be processed by the core. The instructionconverter may be implemented in software, hardware, firmware, or acombination thereof. The instruction converter may be on processor, offprocessor, or part on and part off processor.

FIG. 16 is a block diagram contrasting the use of a software instructionconverter to convert binary instructions in a source instruction set tobinary instructions in a target instruction set according to embodimentsof the invention. In the illustrated embodiment, the instructionconverter is a software instruction converter, although alternativelythe instruction converter may be implemented in software, firmware,hardware, or various combinations thereof. FIG. 16 shows a program in ahigh level language 1602 may be compiled using an x86 compiler 1604 togenerate x86 binary code 1606 that may be natively executed by aprocessor with at least one x86 instruction set core 1616. The processorwith at least one x86 instruction set core 1616 represents any processorthat can perform substantially the same functions as an Intel processorwith at least one x86 instruction set core by compatibly executing orotherwise processing (1) a substantial portion of the instruction set ofthe Intel x86 instruction set core or (2) object code versions ofapplications or other software targeted to run on an Intel processorwith at least one x86 instruction set core, in order to achievesubstantially the same result as an Intel processor with at least onex86 instruction set core. The x86 compiler 1604 represents a compilerthat is operable to generate x86 binary code 1606 (e.g., object code)that can, with or without additional linkage processing, be executed onthe processor with at least one x86 instruction set core 1616.Similarly, FIG. 16 shows the program in the high level language 1602 maybe compiled using an alternative instruction set compiler 1608 togenerate alternative instruction set binary code 1610 that may benatively executed by a processor without at least one x86 instructionset core 1614 (e.g., a processor with cores that execute the MIPSinstruction set of MIPS Technologies of Sunnyvale, Calif. and/or thatexecute the ARM instruction set of ARM Holdings of Sunnyvale, Calif.).The instruction converter 1612 is used to convert the x86 binary code1606 into code that may be natively executed by the processor without anx86 instruction set core 1614. This converted code is not likely to bethe same as the alternative instruction set binary code 1610 because aninstruction converter capable of this is difficult to make; however, theconverted code will accomplish the general operation and be made up ofinstructions from the alternative instruction set. Thus, the instructionconverter 1612 represents software, firmware, hardware, or a combinationthereof that, through emulation, simulation or any other process, allowsa processor or other electronic device that does not have an x86instruction set processor or core to execute the x86 binary code 1606.

Components, features, and details described for any of FIGS. 1-2 and 5-8may also optionally be used in any of FIGS. 3-4. Moreover, components,features, and details described herein for any of the apparatusdescribed herein may also optionally be used in and/or apply to any ofthe methods described herein, which in embodiments may be performed byand/or with such apparatus. Any of the processors described herein maybe included in any of the computer systems, systems-on-chip (SoC) orother systems disclosed herein. In some embodiments, the instructionsmay have features or details of the instruction formats disclosedherein, although this is not required.

In the description and claims, the terms “coupled” and/or “connected,”along with their derivatives, may have be used. These terms are notintended as synonyms for each other. Rather, in embodiments, “connected”may be used to indicate that two or more elements are in direct physicaland/or electrical contact with each other. “Coupled” may mean that twoor more elements are in direct physical and/or electrical contact witheach other. However, “coupled” may also mean that two or more elementsare not in direct contact with each other, but yet still co-operate orinteract with each other. For example, an execution unit may be coupledwith a register and/or a decode unit through one or more interveningcomponents. In the figures, arrows are used to show connections andcouplings.

The term “and/or” may have been used. As used herein, the term “and/or”means one or the other or both (e.g., A and/or B means A or B or both Aand B).

In the description above, specific details have been set forth in orderto provide a thorough understanding of the embodiments. However, otherembodiments may be practiced without some of these specific details. Thescope of the invention is not to be determined by the specific examplesprovided above, but only by the claims below. In other instances,well-known circuits, structures, devices, and operations have been shownin block diagram form and/or without detail in order to avoid obscuringthe understanding of the description. Where considered appropriate,reference numerals, or terminal portions of reference numerals, havebeen repeated among the figures to indicate corresponding or analogouselements, which may optionally have similar or the same characteristics,unless specified or clearly apparent otherwise.

Certain operations may be performed by hardware components, or may beembodied in machine-executable or circuit-executable instructions, thatmay be used to cause and/or result in a machine, circuit, or hardwarecomponent (e.g., a processor, potion of a processor, circuit, etc.)programmed with the instructions performing the operations. Theoperations may also optionally be performed by a combination of hardwareand software. A processor, machine, circuit, or hardware may includespecific or particular circuitry or other logic (e.g., hardwarepotentially combined with firmware and/or software) is operable toexecute and/or process the instruction and store a result in response tothe instruction.

Some embodiments include an article of manufacture (e.g., a computerprogram product) that includes a machine-readable medium. The medium mayinclude a mechanism that provides, for example stores, information in aform that is readable by the machine. The machine-readable medium mayprovide, or have stored thereon, an instruction or sequence ofinstructions, that if and/or when executed by a machine are operable tocause the machine to perform and/or result in the machine performing oneor operations, methods, or techniques disclosed herein. Themachine-readable medium may store or otherwise provide one or more ofthe embodiments of the instructions disclosed herein.

In some embodiments, the machine-readable medium may include a tangibleand/or non-transitory machine-readable storage medium. For example, thetangible and/or non-transitory machine-readable storage medium mayinclude a floppy diskette, an optical storage medium, an optical disk,an optical data storage device, a CD-ROM, a magnetic disk, amagneto-optical disk, a read only memory (ROM), a programmable ROM(PROM), an erasable-and-programmable ROM (EPROM), anelectrically-erasable-and-programmable ROM (EEPROM), a random accessmemory (RAM), a static-RAM (SRAM), a dynamic-RAM (DRAM), a Flash memory,a phase-change memory, a phase-change data storage material, anon-volatile memory, a non-volatile data storage device, anon-transitory memory, a non-transitory data storage device, or thelike. The non-transitory machine-readable storage medium does notconsist of a transitory propagated signal.

Examples of suitable machines include, but are not limited to, ageneral-purpose processor, a special-purpose processor, an instructionprocessing apparatus, a digital logic circuit, an integrated circuit, orthe like. Still other examples of suitable machines include a computingdevice or other electronic device that includes a processor, instructionprocessing apparatus, digital logic circuit, or integrated circuit.Examples of such computing devices and electronic devices include, butare not limited to, desktop computers, laptop computers, notebookcomputers, tablet computers, netbooks, smartphones, cellular phones,servers, network devices (e.g., routers and switches.), Mobile Internetdevices (MIDs), media players, smart televisions, nettops, set-topboxes, and video game controllers.

Reference throughout this specification to “one embodiment,” “anembodiment,” “one or more embodiments,” “some embodiments,” for example,indicates that a particular feature may be included in the practice ofthe invention but is not necessarily required to be. Similarly, in thedescription various features are sometimes grouped together in a singleembodiment, Figure, or description thereof for the purpose ofstreamlining the disclosure and aiding in the understanding of variousinventive aspects. This method of disclosure, however, is not to beinterpreted as reflecting an intention that the invention requires morefeatures than are expressly recited in each claim. Rather, as thefollowing claims reflect, inventive aspects lie in less than allfeatures of a single disclosed embodiment. Thus, the claims followingthe Detailed Description are hereby expressly incorporated into thisDetailed Description, with each claim standing on its own as a separateembodiment of the invention.

EXAMPLE EMBODIMENTS

The following examples pertain to further embodiments. Specifics in theexamples may be used anywhere in one or more embodiments.

Example 1 is a processor or other apparatus that includes a decode unitto decode an SM3 two round state word update instruction. The SM3 tworound state word update instruction is to indicate one or more sourcepacked data operands. The one or more source packed data operands are tohave eight 32-bit state words A_(j), B_(j), C_(j), D_(j), E_(j), F_(j),G_(j), and H_(j) that are to correspond to a round (j) of an SM3 hashalgorithm. The one or more source packed data operands are also to havea set of messages that are sufficient to evaluate two rounds of the SM3hash algorithm. The processor also includes an execution unit coupledwith the decode unit. The execution unit is operable, in response to theSM3 two round state word update instruction, to store one or more resultpacked data operands, in one or more destination storage locations thatare to be indicated by the SM3 two round state word update instruction.The one or more result packed data operands to have at least fourtwo-round updated 32-bit state words A_(j+2), B_(j+2), E_(j+2), andF_(j+2) that are to correspond to a round (j+2) of the SM3 hashalgorithm.

Example 2 includes the processor of Example 1, in which the executionunit is operable, in response to the instruction, to store the one ormore result packed data operands that are to have only the fourtwo-round updated 32-bit state words A_(j+2), B_(j+2), E_(j+2), andF_(j+2).

Example 3 includes the processor of Example 1, in which the executionunit is operable, in response to the instruction, to store the one ormore result packed data operands that are to have eight two-roundupdated 32-bit state words A_(j+2), B_(j+2), C_(j+2), D_(j+2), E_(j+2),F_(j+2), G_(j+2), and H_(j+2) that are to correspond to the round (j+2)of the SM3 hash algorithm.

Example 4 includes the processor of Example 1, in which the decode unitis to decode the instruction that is to indicate a first source packeddata operand that is to have the 32-bit state words A_(j), B_(j), E_(j),and F_(j). The instruction is also to indicate a second source packeddata operand that is to have the 32-bit state words C_(j), D_(j), G_(j),and H_(j).

Example 5 includes the processor of Example 4, in which execution unitis operable, in response to the instruction, to store a single resultpacked data operand that is to have only the four two-round updated32-bit state words A_(j+2), B_(j+2), E_(j+2), and F_(j+2).

Example 6 includes the processor of Example 5, in which execution unitis operable, in response to the SM3 two round state word updateinstruction, to store the single result packed data operand in a storagelocation that is implicitly to be used for both the single result packeddata operand and the second source packed data operand.

Example 7 includes the processor of Example 5, in which the decode unitis to decode a second instruction that is to indicate a source packeddata operand that is to have the 32-bit state words A_(j), B_(j), E_(j),and F_(j). The processor is operable, in response to the secondinstruction, to store a result packed data operand in a destinationstorage location that is to be indicated by the second instruction. Theresult packed data operand is to have four two-round updated 32-bitstate words C_(j+2), D_(j+2), G_(j+2), and H_(j+2) that are tocorrespond to the round (j+2) of the SM3 hash algorithm.

Example 8 includes the processor of any one of Examples 1 to 7, in whichthe decode unit is to decode the instruction that is to indicate the oneor more source packed data operands that are to have one of: four 32-bitmessages W_(j), W_(j+1), W_(j+4), and W_(j+5); and four 32-bit messagesW_(j), W_(j+1), W′_(j), and W′_(j+1).

Example 9 includes the processor of any one of Examples 1 to 7, in whichthe decode unit is to decode the instruction that is to indicate a roundnumber.

Example 10 includes the processor of Example 9, in which the decode unitis to decode the instruction that is to have an immediate to indicatethe round number.

Example 11 includes the processor of any one of Examples 1 to 7, inwhich the decode unit is to decode the instruction that is to indicatethree 128-bit source packed data operands that are to have the eight32-bit state words A_(j), B_(j), C_(j), D_(j), E_(j), F_(j), G_(j), andH_(j) and the set of messages that are sufficient to evaluate the tworounds of the SM3 hash algorithm.

Example 12 includes the processor of Example 11, in which the decodeunit is to decode the instruction that is to explicitly specify two ofthe three 128-bit source packed data operands, and implicitly indicateone of the three 128-bit source packed data operands. Also, it is to beimplicit to use a storage location both for one of the three 128-bitsource packed data operands and also to store a result packed dataoperand, and in which the processor has a plurality of 256-bit packeddata registers.

Example 13 includes the processor of any one of Examples 1 to 7, inwhich logic of the execution unit to be used to implement at least oneof an FF_(j) function and GG_(j) function of the SM3 hash algorithm isalso to be used to implement at least one of a Maj function and a Chfunction of a Secure Hash Algorithm.

Example 14 includes the processor of any one of Examples 1 to 7, inwhich the execution unit is operable, in response to the instruction,during each of two rounds, to perform operations including: evaluatingan FF_(j) Boolean function; evaluating a GG_(j) Boolean function; andevaluating a P₀ permutation function.

Example 15 is a method in a processor that includes receiving an SM3 tworound state word update instruction indicating one or more source packeddata operands. The one or more source packed data operands have eight32-bit state words A_(j), B_(j), C_(j), D_(j), E_(j), F_(j), G_(j), andH_(j) for a round (j) of an SM3 hash algorithm, and the one or moresource packed data operands having four messages to evaluate two roundsof the SM3 hash algorithm. The method also includes storing one or moreresult packed data operands, in one or more destination storagelocations indicated by the SM3 two round state word update instruction,in response to the SM3 two round state word update instruction. The oneor more result packed data operands have at least four two-round updated32-bit state words A_(j+2), B_(j+2), E_(j+2), and F_(j+2), which havebeen updated by the two rounds of the SM3 hash algorithm relative toA_(j), B_(j), E_(j), and F_(j).

Example 16 includes the method of Example 15, in which receivingincludes receiving the instruction that indicates a round number andthat indicates the one or more source packed data operands that have oneof: four 32-bit messages W_(j), W_(j+1), W_(j+4), and W_(j+5); and four32-bit messages W_(j), W_(j+1), W′_(j), and W′_(j+1).

Example 17 includes the method of any one of Examples 15 and 16, inwhich storing includes storing the one or more result packed dataoperands that have eight two-round updated 32-bit state words A_(j+2),B_(j+2), C_(j+2), D_(j+2), E_(j+2), F_(j+2), G_(j+2), and H_(j+2), whichhave been updated by the two rounds of the SM3 hash algorithm.

Example 18 includes the method of any one of Examples 15 and 16, inwhich receiving includes receiving the instruction that indicates afirst source packed data operand having the 32-bit state words A_(j),B_(j), E_(j), and F_(j), and indicates a second source packed dataoperand having the 32-bit state words C_(j), D_(j), G_(j), and H_(j).

Example 19 includes the method of any one of Examples 15 and 18, inwhich storing includes storing a single result packed data operand thathas only the four two-round updated 32-bit state words A_(j+2), B_(j+2),E_(j+2), and F_(j+2).

Example 20 includes the method of any one of Examples 15, 18, and 19,further including receiving a second instruction that indicates a sourcepacked data operand having the 32-bit state words A_(j), B_(j), E_(j),and F_(j). The method further includes storing a result packed dataoperand, in a destination storage location indicated by the secondinstruction, in response to the second instruction. The result packeddata operand has four two-round updated 32-bit state words C_(j+2),D_(j+2), G_(j+2), and H_(j+2) that are to correspond to a round (j+2) ofthe SM3 hash algorithm.

Example 21 is a system to process instructions that includes aninterconnect and a processor coupled with the interconnect. Theprocessor is to receive a two round state word update instruction for ahash algorithm. The hash algorithm utilizes a parameter T_(j) having ahexadecimal value of 79cc4519 for a first set of rounds and ahexadecimal value of 79cc4519 for a second set of rounds. The two roundstate word update instruction is to indicate one or more source packeddata operands. The one or more source packed data operands are to haveeight 32-bit state words A_(j), B_(j), C_(j), D_(j), E_(j), F_(j),G_(j), and H_(j) that are to correspond to a round (j) of the hashalgorithm, and the one or more source packed data operands to have a setof messages that are sufficient to evaluate two rounds of the hashalgorithm. The processor, in response to the two round state word updateinstruction, is to store one or more result packed data operands, in oneor more destination storage locations that are to be indicated by thetwo round state word update instruction. The one or more result packeddata operands to have at least four state words A_(j+2), B_(j+2),E_(j+2), and F_(j+2), which respectively have been updated by two roundsof the hash algorithm relative to the four 32-bit state words A_(j),B_(j), E_(j), and F_(j). The system also includes a dynamic randomaccess memory (DRAM) coupled with the interconnect. The DRAM stores aset of instructions to implement the hash algorithm. The set ofinstructions, when executed by the processor, to cause the processor toperform operations including using A_(j), B_(j), E_(j), and F_(j) togenerate C_(j+2), D_(j+2), G_(j+2), and H_(j+2), which respectively havebeen updated by two rounds of the hash algorithm relative to C_(j),D_(j), G_(j), and H_(j).

Example 22 includes the system of Example 21, in which using the A_(j),B_(j), E_(j), and F_(j) to generate the Cj+2, Dj+2, Gj+2 is responsiveto a single instruction.

Example 23 is an article of manufacture including a non-transitorymachine-readable storage medium. The non-transitory machine-readablestorage medium stores an SM3 two round state word update instruction.The SM3 two round state word update instruction is to indicate one ormore source packed data operands. The one or more source packed dataoperands are to have eight 32-bit state words A_(j), B_(j), C_(j),D_(j), E_(j), F_(j), G_(j), and H_(j) for a round (j) of an SM3 hashalgorithm, and the one or more source packed data operands to have fourmessages sufficient to evaluate two rounds of the SM3 hash algorithm.The SM3 two round state word update instruction if executed by a machineis to cause the machine to perform operations including generating atleast four two-round updated 32-bit state words A_(j+2), B_(j+2),E_(j+2), and F_(j+2), which respectively have been updated by two roundsof the SM3 hash algorithm relative to A_(j), B_(j), E_(j), and F_(j).The operations also include storing the at least four 32-bit state wordsA_(j+2), B_(j+2), E_(j+2), and F_(j+2) in one or more destinationstorage locations that are to be indicated by the SM3 two round stateword update instruction.

Example 24 includes the article of manufacture of Example 23, in whichstoring includes storing the at least four 32-bit state words A_(j+2),B_(j+2), E_(j+2), and F_(j+2) in a 128-bit register, and in which thestorage medium further includes an instruction that if executed by themachine is to cause the machine to perform operations includinggenerating four two-round updated 32-bit state words C_(j+2), D_(j+2),G_(j+2), and H_(j+2) from four 32-bit state words A_(j), B_(j), E_(j),and F_(j).

Example 25 includes a processor or other apparatus that is operative toperform the method of any one of Examples 15-20.

Example 26 includes a processor or other apparatus that includes meansfor performing the method of any one of Examples 15-20.

Example 27 includes a processor that includes any combination ofmodules, units, logic, circuitry, and means to perform the method of anyone of Examples 15-20.

Example 28 includes an article of manufacture that includes anoptionally non-transitory machine-readable medium that optionally storesor otherwise provides an instruction that if and/or when executed by aprocessor, computer system, or other machine is operative to cause themachine to perform the method of any one of Examples 15-20.

Example 29 includes a computer system or other electronic deviceincluding an interconnect, the processor of any one of Examples 1-14coupled with the interconnect, and at least one component coupled withthe interconnect that is selected from a dynamic random access memory(DRAM), a network interface, a graphics chip, a wireless communicationschip, a Global System for Mobile Communications (GSM) antenna, a phasechange memory, and a video camera.

Example 30 includes a processor or other apparatus substantially asdescribed herein.

Example 31 includes a processor or other apparatus that is operative toperform any method substantially as described herein.

Example 32 includes a processor or other apparatus including means forperforming any method substantially as described herein.

Example 33 includes a processor or other apparatus that is operative toperform any SM3 hash algorithm acceleration instruction substantially asdescribed herein.

Example 34 includes a processor or other apparatus including means forperforming any SM3 hash algorithm acceleration instruction substantiallyas described herein.

Example 35 includes a processor or other apparatus including a decodeunit that is operable to decode instructions of a first instruction set.The decode unit is to receive one or more instructions that emulate afirst instruction, which may be any of the SM3 hash algorithmacceleration instructions substantially as disclosed herein, and whichis to be of a second instruction set. The processor or other apparatusalso includes one or more execution units coupled with the decode unitto execute the one or more instructions of the first instruction set.The one or more execution units in response to the one or moreinstructions of the first instruction set are operable to store a resultin a destination. The result may include any of the resultssubstantially as disclosed herein for the first instruction.

Example 36 includes a computer system or other electronic device thatincludes a processor having a decode unit that is operable to decodeinstructions of a first instruction set, and having one or moreexecution units. The computer system also includes a storage devicecoupled to the processor. The storage device is to store a firstinstruction, which may be any of the SM3 hash algorithm accelerationinstructions substantially as disclosed herein, and which is to be of asecond instruction set. The storage device is also to store instructionsto convert the first instruction into one or more instructions of thefirst instruction set. The one or more instructions of the firstinstruction set, when executed by the processor, are operable to causethe processor to store a result in a destination. The result may includeany of the results substantially as disclosed herein for the firstinstruction.

What is claimed is:
 1. A processor comprising: a decode unit to decodean SM3 two round state word update instruction, the SM3 two round stateword update instruction to indicate one or more source packed dataoperands, the one or more source packed data operands to have eight32-bit state words A_(j), B_(j), C_(j), D_(j), E_(j), F_(j), G_(j), andH_(j) that are to correspond to a round (j) of an SM3 hash algorithm,and the one or more source packed data operands to have a set ofmessages that are sufficient to evaluate two rounds of the SM3 hashalgorithm; and an execution unit coupled with the decode unit, theexecution unit operable, in response to the SM3 two round state wordupdate instruction, to store one or more result packed data operands, inone or more destination storage locations that are to be indicated bythe SM3 two round state word update instruction, the one or more resultpacked data operands to have at least four two-round updated 32-bitstate words A_(j+2), B_(j+2), E_(j+2), and F_(j+2) that are tocorrespond to a round (j+2) of the SM3 hash algorithm.
 2. The processorof claim 1, wherein the execution unit is operable, in response to theinstruction, to store the one or more result packed data operands thatare to have only the four two-round updated 32-bit state words A_(j+2),B_(j+2), E_(j+2), and F_(j+2).
 3. The processor of claim 1, wherein theexecution unit is operable, in response to the instruction, to store theone or more result packed data operands that are to have eight two-roundupdated 32-bit state words A_(j+2), B_(j+2), C_(j+2), D_(j+2), E_(j+2),F_(j+2), G_(j+2), and H_(j+2) that are to correspond to the round (j+2)of the SM3 hash algorithm.
 4. The processor of claim 1, wherein thedecode unit is to decode the instruction that is to indicate a firstsource packed data operand that is to have the 32-bit state words A_(j),B_(j), E_(j), and F_(j), and is to indicate a second source packed dataoperand that is to have the 32-bit state words C_(j), D_(j), G_(j), andH_(j).
 5. The processor of claim 4, wherein the execution unit isoperable, in response to the instruction, to store a single resultpacked data operand that is to have only the four two-round updated32-bit state words A_(j+2), B_(j+2), E_(j+2), and F_(j+2).
 6. Theprocessor of claim 5, wherein the execution unit is operable, inresponse to the SM3 two round state word update instruction, to storethe single result packed data operand in a storage location that isimplicitly to be used for both the single result packed data operand andthe second source packed data operand.
 7. The processor of claim 5,wherein the decode unit is to decode a second instruction that is toindicate a source packed data operand that is to have the 32-bit statewords A_(j), B_(j), E_(j), and F_(j), and wherein the processor isoperable, in response to the second instruction, to store a resultpacked data operand in a destination storage location that is to beindicated by the second instruction, the result packed data operand tohave four two-round updated 32-bit state words C_(j+2), D_(j+2),G_(j+2), and H_(j+2) that are to correspond to the round (j+2) of theSM3 hash algorithm.
 8. The processor of claim 1, wherein the decode unitis to decode the instruction that is to indicate the one or more sourcepacked data operands that are to have one of: four 32-bit messagesW_(j), W_(j+1), W_(j+4), and W_(j+5); and four 32-bit messages W_(j),W_(j+1), W′_(j), and W′_(j+1).
 9. The processor of claim 1, wherein thedecode unit is to decode the instruction that is to indicate a roundnumber.
 10. The processor of claim 9, wherein the decode unit is todecode the instruction that is to have an immediate to indicate theround number.
 11. The processor of claim 1, wherein the decode unit isto decode the instruction that is to indicate three 128-bit sourcepacked data operands that are to have the eight 32-bit state wordsA_(j), B_(j), C_(j), D_(j), E_(j), F_(j), G_(j), and H_(j) and the setof messages that are sufficient to evaluate the two rounds of the SM3hash algorithm.
 12. The processor of claim 11, wherein the decode unitis to decode the instruction that is to explicitly specify two of thethree 128-bit source packed data operands, and implicitly indicate oneof the three 128-bit source packed data operands, and wherein it is tobe implicit to use a storage location both for one of the three 128-bitsource packed data operands and also to store a result packed dataoperand, and wherein the processor has a plurality of 256-bit packeddata registers.
 13. The processor of claim 1, wherein logic of theexecution unit to be used to implement at least one of an FF_(j)function and GG_(j) function of the SM3 hash algorithm is also to beused to implement at least one of a Maj function and a Ch function of aSecure Hash Algorithm.
 14. The processor of claim 1, wherein theexecution unit is operable, in response to the instruction, during eachof two rounds, to perform operations comprising: evaluating an FF_(j)Boolean function; evaluating a GG_(j) Boolean function; and evaluating aP₀ permutation function.
 15. A method in a processor comprising:receiving an SM3 two round state word update instruction indicating oneor more source packed data operands, the one or more source packed dataoperands having eight 32-bit state words A_(j), B_(j), C_(j), D_(j),E_(j), F_(j), G_(j), and H_(j) for a round (j) of an SM3 hash algorithm,and the one or more source packed data operands having four messages toevaluate two rounds of the SM3 hash algorithm; and storing one or moreresult packed data operands, in one or more destination storagelocations indicated by the SM3 two round state word update instruction,in response to the SM3 two round state word update instruction, the oneor more result packed data operands having at least four two-roundupdated 32-bit state words A_(j+2), B_(j+2), E_(j+2), and F_(j+2), whichhave been updated by the two rounds of the SM3 hash algorithm relativeto A_(j), B_(j), E_(j), and F_(j).
 16. The method of claim 15, whereinreceiving comprises receiving the instruction that indicates a roundnumber and that indicates the one or more source packed data operandsthat have one of: four 32-bit messages W_(j), W_(j+1), W_(j+4), andW_(j+5); and four 32-bit messages W_(j), W_(j+1), W′_(j), and W′_(j+1).17. The method of claim 15, wherein storing comprises storing the one ormore result packed data operands that have eight two-round updated32-bit state words A_(j+2), B_(j+2), C_(j+2), D_(j+2), E_(j+2), F_(j+2),G_(j+2), and H_(j+2), which have been updated by the two rounds of theSM3 hash algorithm.
 18. The method of claim 15, wherein receivingcomprises receiving the instruction that indicates a first source packeddata operand having the 32-bit state words A_(j), B_(j), E_(j), andF_(j), and indicates a second source packed data operand having the32-bit state words C_(j), D_(j), G, and H_(j).
 19. The method of claim18, wherein storing comprises storing a single result packed dataoperand that has only the four two-round updated 32-bit state wordsA_(j+2), B_(j+2), E_(j+2), and F_(j+2).